Get‑CertificatePrivateKeyAccessRule

SYNOPSIS

Gets typed access rules from a supported certificate private-key DACL.

SYNTAX

Certificate (Default)

Get-CertificatePrivateKeyAccessRule -Certificate <X509Certificate2> -ProviderName <String> -KeyName <String>
 [-Account <Object[]>] [<CommonParameters>]

Key

Get-CertificatePrivateKeyAccessRule -ProviderName <String> -KeyName <String> -KeyScope <String>
 [-Account <Object[]>] [<CommonParameters>]

DESCRIPTION

Reads the persisted private-key DACL and emits typed rules. The key is addressed either through an exact caller-owned X.509 certificate plus the expected CNG provider and key name, or, when no certificate is available, through the provider, key name, and key scope alone. The provider must be the Microsoft Software Key Storage Provider and must report a software-only implementation.

EXAMPLES

EXAMPLE 1

$certificate = Get-Item 'Cert:\LocalMachine\My\0123456789ABCDEF'
Get-CertificatePrivateKeyAccessRule -Certificate $certificate `
    -ProviderName 'Microsoft Software Key Storage Provider' `
    -KeyName 'WorkloadKey'

Gets every typed access rule on the exact supported CNG key.

PARAMETERS

-Account

Filters results by account names, SIDs, identity references, or module identities.

Type: Object[]
Parameter Sets: (All)
Aliases: IdentityReference, ID

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Certificate

An exact X509Certificate2 object with the private key to inspect. The command does not dispose the caller-owned certificate.

Type: X509Certificate2
Parameter Sets: Certificate
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: True (ByValue)
Accept wildcard characters: False

-KeyName

The exact expected persisted CNG key name.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-KeyScope

Selects the machine or current-user key store when the key is addressed without a certificate.

Type: String
Parameter Sets: Key
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ProviderName

The exact expected CNG provider.

Type: String
Parameter Sets: (All)
Aliases:

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

System.Security.Cryptography.X509Certificates.X509Certificate2

OUTPUTS

WindowsAccessControl.CertificatePrivateKeyAccessRule

NOTES

RELATED LINKS