Verify Specific Certificate is Installed

Question

I have hundreds of servers I need to verify that specific certificates are installed from time to time. Rather than logging in and spot checking them, I'd like to run a script that can verify. I've looked through numerous postings using CERTUTIL which seems
to be the correct tool but I'm just not finding the write verbose. I can use the -store command and see there are some 50 certs installed, I can even see my cert I'm trying to verify. Rather than having to look through the entire list I was trying to find
just that one cert. When I use the -isvalid tag and specify the serial number or hash tag I get:
CertUtil: No local Certification Authority; use -config option
CertUtil: No more data is available.
I know I'm missing something here but just can't find it. Can anyone point me in the right direction?

Answer 1

If you have PowerShell Remoting enabled on these computers, you can use PowerShell's Cert: drive to check it, rather than trying to parse the output of CertUtil.  For example:
Invoke-Command -ComputerName SomeRemoteComputer -ScriptBlock {
Get-ChildItem -Path Cert:\LocalMachine -Include SomeCertificateThumbprint -Recurse |
Select-Object -First 1
If you know which certificate store you need to query, you can also just look for the certificate right in the remote computer's registry.  For example, you could look for the registry key "HKEY_LOCAL_MACHINE\Software\Microsoft\SystemCertificates\MY\Certificates\SomeCertificateThumbprint"