functions/Remove-DbaComputerCertificate.ps1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
function Remove-DbaComputerCertificate {
<#
    .SYNOPSIS
        Removes a computer certificate - useful for removing easily certs from remote computers
     
    .DESCRIPTION
        Removes a computer certificate from a local or remote compuer
     
    .PARAMETER ComputerName
        The target computer - defaults to localhost
     
    .PARAMETER Credential
        Allows you to login to $ComputerName using alternative credentials
     
    .PARAMETER Certificate
        The target certificate object
     
    .PARAMETER Thumbprint
        The thumbprint of the certificate object
     
    .PARAMETER Store
        Certificate store - defaults to LocalMachine (otherwise exceptions can be thrown on remote connections)
     
    .PARAMETER Folder
        Certificate folder
     
    .PARAMETER Silent
        Use this switch to disable any kind of verbose messages
     
    .PARAMETER WhatIf
        Shows what would happen if the command were to run. No actions are actually performed.
     
    .PARAMETER Confirm
        Prompts you for confirmation before executing any changing operations within the command.
     
    .EXAMPLE
        Remove-DbaComputerCertificate -ComputerName Server1 -Thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94
         
        Removes certificate with thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 in the LocalMachine store on Server1
     
    .EXAMPLE
        Remove-DbaComputerCertificate -ComputerName Server1 -Thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 -Store User -Folder My
         
        Removes certificate with thumbprint C2BBE81A94FEE7A26FFF86C2DFDAF6BFD28C6C94 in the User\My (Personal) store on Server1
     
    .NOTES
        Tags: Certificate
         
        Website: https://dbatools.io
        Copyright: (C) Chrissy LeMaire, clemaire@gmail.com
        License: GNU GPL v3 https://opensource.org/licenses/GPL-3.0
#>

    [CmdletBinding(SupportsShouldProcess = $true, ConfirmImpact = "High")]
    param (
        [Alias("ServerInstance", "SqlServer", "SqlInstance")]
        [DbaInstanceParameter[]]
        $ComputerName = $env:COMPUTERNAME,
        
        [PSCredential]
        
        $Credential,
        
        [parameter(ParameterSetName = "Certificate", ValueFromPipeline)]
        [System.Security.Cryptography.X509Certificates.X509Certificate2]
        $Certificate,
        
        [string]
        $Thumbprint,
        
        [string]
        $Store = "LocalMachine",
        
        [string]
        $Folder,
        
        [switch]
        $Silent
    )
    
    process {
        
        if (-not $Certificate -and -not $Thumbprint) {
            Stop-Function -Message "You must specify either Certificate or Thumbprint" -Category InvalidArgument
            return
        }
        
        if ($Certificate) {
            $thumbprint = $Certificate.Thumbprint
        }
        
        foreach ($computer in $computername) {
            
            $scriptblock = {
                $thumbprint = $args[0]
                $Store = $args[1]
                $Folder = $args[2]
                
                Write-Verbose "Searching Cert:\$Store\$Folder for thumbprint: $thumbprint"
                $cert = Get-ChildItem "Cert:\$store\$folder" -Recurse | Where-Object { $_.Thumbprint -eq $cert.Thumbprint }
                
                if ($cert) {
                    $cert | Remove-Item
                    $status = "Removed"
                }
                else {
                    $status = "Certificate not found in Cert:\$Store\$Folder"
                }
                
                [pscustomobject]@{
                    ComputerName = $env:COMPUTERNAME
                    Thumbprint   = $thumbprint
                    Status         = $status
                }
            }
            
            if ($PScmdlet.ShouldProcess("local", "Connecting to $computer to remove cert from Cert:\$Store\$Folder")) {
                try {
                    Invoke-Command2 -ComputerName $computer -Credential $Credential -ArgumentList $thumbprint, $store, $folder -ScriptBlock $scriptblock -ErrorAction Stop
                }
                catch {
                    Stop-Function -Message $_ -ErrorRecord $_ -Target $computer -Continue
                }
            }
        }
    }
}