WIN-010 · Script
Certificate Expiration Monitor
Finds machine certificates that are expired or will expire soon.
Version 1.0.0Language PowerShellUpdated November 2026Report only, changes nothing
What it does
Checks the local computer certificate stores (Personal and Web Hosting by default) for certificates that have a private key and are expiring within the warning window. Useful for web servers, RD Gateways, VPN, Wi-Fi (802.1X), and printers that rely on device certificates. Read-only.
Requirements
Windows PowerShell 5.1+, run as SYSTEM or local admin
How to run it
- Run as: SYSTEM or a local administrator
- Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
- Script type: PowerShell, 64-bit
- User interaction: none; the script never prompts
- Timeout: 10 minutes (30 for Windows Update installs)
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| WarningDays | Alert on certificates expiring within this many days. Default 30. | 30 | |
| Stores | Certificate stores under LocalMachine to check. Default My and WebHosting. | My, WebHosting | |
| IncludeExpired | Also alert on certificates that have already expired. Off by default because old expired certificates are often left behind harmlessly. | False |
Exit codes
- 0 = none expiring, 1 = expiring certificates found, 2 = script error
Testing steps
- Run it on one test device and check the output and log.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Report only. Nothing is changed, so nothing needs to be rolled back.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |