Documentation

1. Purpose

The CBOM WinCerts sensor (Discover_WinCerts) performs read-only discovery of cryptographic material stored in the Windows Local Machine certificate stores. This includes certificates, public keys, certificate chains, and associated metadata such as subject, issuer, validity periods, key algorithms, and key lengths.

The sensor reads from the following Windows certificate stores:

MY — Personal certificates, including those with associated private keys
ROOT — Trusted Root Certificate Authorities
CA — Intermediate Certificate Authorities
TRUST — Enterprise Trust store
TrustedPeople — Certificates for trusted individuals
TrustedPublisher — Certificates for trusted software publishers

This guide covers creating a dedicated Windows service account, granting the minimum required permissions to access the Local Machine certificate stores, deploying the sensor as a Windows service or scheduled task, and validating successful discovery.

2. Prerequisites

Before beginning this setup, ensure the following requirements are met:

You have administrative access to the target Windows machine or domain.
The target machine runs Windows Server 2016 or later, or Windows 10/11.
Active Directory Users and Computers (ADUC) is available if creating a domain service account, or Local Users and Groups is accessible for local accounts.
The CBOM sensor package has been downloaded and extracted on the target machine.
PowerShell 5.1 or later is available on the target machine.
The certlm.msc snap-in is accessible (run as Administrator).
certutil.exe is available on the target machine (included with Windows by default).
Network connectivity exists between the target machine and the CBOM platform endpoint.
You have the CBOM platform URL and a valid API token for sensor registration.

3. Create a Dedicated Service Account

A dedicated, least-privilege service account must be created to run the Discover_WinCerts sensor. Do not use a personal account or a highly privileged account such as Domain Admin.

3.1 Create a Domain Service Account (Active Directory)

Perform these steps on a domain controller or a machine with ADUC installed:

Open Active Directory Users and Computers (dsa.msc).
Navigate to the appropriate Organizational Unit (OU), for example Service Accounts.
Right-click the OU and select New > User.
Fill in the account details: - First name: CBOM - Last name: WinCerts - User logon name: svc-cbom-wincerts
Click Next and set a strong password. Enable Password never expires and User cannot change password.
Click Next, then Finish.
Right-click the newly created account and select Properties.
On the Account tab, confirm the account is not set to expire.
Note the full account name: DOMAIN\svc-cbom-wincerts.

3.2 Create a Local Service Account (Non-Domain Machine)

Perform these steps directly on the target Windows machine:

Open Computer Management (compmgmt.msc) as Administrator.
Expand Local Users and Groups > Users.
Right-click Users and select New User.
Fill in the account details: - User name: svc-cbom-wincerts - Full name: CBOM WinCerts Sensor - Description: Read-only service account for CBOM certificate discovery
Set a strong password. Check Password never expires and User cannot change password.
Uncheck User must change password at next logon.
Click Create, then Close.

4. Grant Read Access to the Windows Certificate Stores

The service account requires read access to the Local Machine certificate stores. The Personal (MY) store may have private key ACLs that must be configured separately.

4.1 Grant Access to the MY (Personal) Store Private Keys

Private keys stored in the MY store have individual ACLs that must be updated:

Open certlm.msc (Local Machine Certificate Manager) as Administrator:
```
certlm.msc
```
Expand Personal > Certificates.
For each certificate that has a private key (indicated by a key icon): - Right-click the certificate and select All Tasks > Manage Private Keys. - In the permissions dialog, click Add. - Enter the service account name: svc-cbom-wincerts (or DOMAIN\svc-cbom-wincerts for domain accounts). - Click Check Names to verify, then click OK. - In the permissions list, grant Read permission only. - Click OK to save.

4.2 Grant Read Access to Other Certificate Stores

The ROOT, CA, TRUST, TrustedPeople, and TrustedPublisher stores are readable by all authenticated users by default on Windows. Verify this with the following PowerShell command run as Administrator:

$stores = @("ROOT", "CA", "TRUST", "TrustedPeople", "TrustedPublisher")
foreach ($store in $stores) {
    $certStore = New-Object System.Security.Cryptography.X509Certificates.X509Store($store, "LocalMachine")
    try {
        $certStore.Open("ReadOnly")
        Write-Host "Store '$store': Accessible (ReadOnly)" -ForegroundColor Green
        $certStore.Close()
    } catch {
        Write-Host "Store '$store': NOT accessible - $_" -ForegroundColor Red
    }
}

If any store returns an access error, open certlm.msc, right-click the affected store, select Properties, go to the Security tab, and add the service account with Read permission.

4.3 Grant Log On as a Service Right

The service account must be granted the Log on as a service right to run as a Windows service:

Open Local Security Policy (secpol.msc) as Administrator.
Navigate to Security Settings > Local Policies > User Rights Assignment.
Double-click Log on as a service.
Click Add User or Group.
Enter svc-cbom-wincerts (or DOMAIN\svc-cbom-wincerts) and click OK.
Click OK to save the policy.

Alternatively, use PowerShell to grant this right programmatically:

$accountName = "svc-cbom-wincerts"
$exportPath = "$env:TEMP\secedit_export.cfg"
secedit /export /cfg $exportPath /quiet

$ntAccount = New-Object System.Security.Principal.NTAccount($accountName)
$sid = $ntAccount.Translate([System.Security.Principal.SecurityIdentifier]).Value

(Get-Content $exportPath) -replace 'SeServiceLogonRight = ', "SeServiceLogonRight = *$sid," |
    Set-Content $exportPath

secedit /import /cfg $exportPath /quiet
secedit /configure /cfg $exportPath /db secedit.sdb /quiet
gpupdate /force

5. Install the CBOM Sensor on the Target Machine

Extract the CBOM sensor package to the installation directory:
```
C:\Program Files\CBOM\Sensors\WinCerts\
```

Verify the extracted contents include:

Discover_WinCerts.exe
sensor-config.yaml
cbom-sensor-runner.exe

Create the log directory:
```
mkdir "C:\Program Files\CBOM\Logs"
```
Set permissions on the log directory so the service account can write logs:
```
icacls "C:\Program Files\CBOM\Logs" /grant "svc-cbom-wincerts:(OI)(CI)M"
```

Restrict permissions on the sensor installation directory:

icacls "C:\Program Files\CBOM\Sensors\WinCerts" /inheritance:r
icacls "C:\Program Files\CBOM\Sensors\WinCerts" /grant "Administrators:(OI)(CI)F"
icacls "C:\Program Files\CBOM\Sensors\WinCerts" /grant "svc-cbom-wincerts:(OI)(CI)RX"

6. Configure CBOM Sensor

Edit the sensor configuration file at:

C:\Program Files\CBOM\Sensors\WinCerts\sensor-config.yaml

The following is a complete configuration example with realistic placeholder values:

sensor:
  name: Discover_WinCerts
  version: "2.4.1"
  description: "Windows Local Machine Certificate Store Discovery"

platform:
  url: "https://cbom.example.com"
  api_token: "cbom_tok_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  organization: "example-org"
  environment: "production"

target:
  hostname: "WIN-APPSERVER01.corp.example.com"
  os: "windows"
  scan_interval_hours: 24

certificate_stores:
  scope: "LocalMachine"
  stores:
    - name: MY
      enabled: true
      include_private_key_metadata: true
    - name: ROOT
      enabled: true
    - name: CA
      enabled: true
    - name: TRUST
      enabled: true
    - name: TrustedPeople
      enabled: true
    - name: TrustedPublisher
      enabled: true

discovery:
  collect_subject: true
  collect_issuer: true
  collect_serial_number: true
  collect_thumbprint: true
  collect_validity_dates: true
  collect_key_algorithm: true
  collect_key_length: true
  collect_san: true
  collect_eku: true
  collect_chain: true
  include_expired: true
  include_self_signed: true

output:
  log_file: "C:\\Program Files\\CBOM\\Logs\\wincerts-sensor.log"
  log_level: "INFO"
  report_format: "json"
  report_path: "C:\\Program Files\\CBOM\\Logs\\wincerts-report.json"

service_account:
  username: "CORP\\svc-cbom-wincerts"

7. Deploy the Sensor as a Windows Service

Register and start the Discover_WinCerts sensor as a Windows service using the dedicated service account:

Open an elevated Command Prompt (Run as Administrator).

Create the Windows service:

sc create "CBOM-WinCerts" ^
  binPath= "\"C:\Program Files\CBOM\Sensors\WinCerts\cbom-sensor-runner.exe\" --config \"C:\Program Files\CBOM\Sensors\WinCerts\sensor-config.yaml\"" ^
  DisplayName= "CBOM WinCerts Sensor" ^
  start= auto ^
  obj= "CORP\svc-cbom-wincerts" ^
  password= "ServiceAccountPassword123!"

Set a description for the service:

sc description "CBOM-WinCerts" "Read-only CBOM sensor for Windows certificate store discovery"

Configure service recovery options:

sc failure "CBOM-WinCerts" reset= 86400 actions= restart/60000/restart/120000/restart/300000

Start the service:
```
sc start "CBOM-WinCerts"
```
Verify the service is running:
```
sc query "CBOM-WinCerts"
```

7.1 Alternative: Deploy as a Scheduled Task

If deploying as a Windows service is not possible, register the sensor as a scheduled task instead:

$action = New-ScheduledTaskAction `
    -Execute "C:\Program Files\CBOM\Sensors\WinCerts\cbom-sensor-runner.exe" `
    -Argument '--config "C:\Program Files\CBOM\Sensors\WinCerts\sensor-config.yaml"'

$trigger = New-ScheduledTaskTrigger -Daily -At "02:00AM"

$principal = New-ScheduledTaskPrincipal `
    -UserId "CORP\svc-cbom-wincerts" `
    -LogonType Password `
    -RunLevel Highest

$settings = New-ScheduledTaskSettingsSet `
    -ExecutionTimeLimit (New-TimeSpan -Hours 2) `
    -RestartCount 3 `
    -RestartInterval (New-TimeSpan -Minutes 10)

Register-ScheduledTask `
    -TaskName "CBOM-WinCerts-Discovery" `
    -TaskPath "\CBOM\" `
    -Action $action `
    -Trigger $trigger `
    -Principal $principal `
    -Settings $settings `
    -Description "CBOM WinCerts Sensor - Daily Certificate Discovery"

8. Validation

After deploying the sensor, confirm it is discovering certificate store contents correctly.

8.1 Verify Certificate Store Access with certutil

On the target machine, open a Command Prompt and run the following commands to confirm the stores are accessible and contain certificates:

certutil -store MY
certutil -store ROOT
certutil -store CA
certutil -store TRUST
certutil -store TrustedPeople
certutil -store TrustedPublisher

Expected output for the MY store:

================ Certificate 0 ================
Serial Number: 3ab412cdef567890abcdef1234567890
Issuer: CN=Corp-Issuing-CA, DC=corp, DC=example, DC=com
NotBefore: 1/15/2025 9:00 AM
NotAfter: 1/15/2026 9:00 AM
Subject: CN=WIN-APPSERVER01.corp.example.com
...
CertUtil: -store command completed successfully.

8.2 Verify Sensor Logs

Check the sensor log file for successful discovery entries:

type "C:\Program Files\CBOM\Logs\wincerts-sensor.log"

Look for log lines similar to:

[INFO] 2026-06-29T02:00:01Z Discover_WinCerts starting scan on WIN-APPSERVER01.corp.example.com
[INFO] 2026-06-29T02:00:02Z Opening store: LocalMachine\MY - found 12 certificates
[INFO] 2026-06-29T02:00:02Z Opening store: LocalMachine\ROOT - found 47 certificates
[INFO] 2026-06-29T02:00:02Z Opening store: LocalMachine\CA - found 23 certificates
[INFO] 2026-06-29T02:00:02Z Opening store: LocalMachine\TRUST - found 5 certificates
[INFO] 2026-06-29T02:00:03Z Scan complete. Total: 89 certificates discovered.
[INFO] 2026-06-29T02:00:03Z Report submitted to https://cbom.example.com - HTTP 200 OK

8.3 Confirm Discovery in CBOM Platform

Log in to the CBOM platform at https://cbom.example.com.
Navigate to Assets > Certificates.
Filter by Source: Discover_WinCerts and Host: WIN-APPSERVER01.corp.example.com.
Confirm that certificates from all enabled stores appear with correct metadata including algorithm, key length, validity dates, and issuer.

9. Common Errors and Resolution

Error 1: Access Denied Opening the MY Certificate Store

[ERROR] CryptographicException: Access to the path 'LocalMachine\MY' is denied.
System.Security.SecurityException: Keyset does not exist

Cause: The service account does not have read access to one or more private key ACLs in the MY store, or the Log on as a service right has not been granted.

Resolution:

Open certlm.msc as Administrator and expand Personal > Certificates.
For each certificate with a private key icon, right-click and select All Tasks > Manage Private Keys.
Add the service account (svc-cbom-wincerts) with Read permission only.
Confirm the Log on as a service right is granted in secpol.msc > User Rights Assignment.
Restart the CBOM-WinCerts service: sc stop "CBOM-WinCerts" && sc start "CBOM-WinCerts".

Error 2: Sensor Fails to Submit Report — HTTP 401 Unauthorized

[ERROR] 2026-06-29T02:00:04Z Failed to submit report to https://cbom.example.com
[ERROR] Response: HTTP 401 Unauthorized - {"error": "Invalid or expired API token"}

Cause: The api_token value in sensor-config.yaml is incorrect, has expired, or has been revoked in the CBOM platform.

Resolution:

Log in to the CBOM platform and navigate to Settings > API Tokens.
Generate a new token or confirm the existing token is active and has not been revoked.

Update sensor-config.yaml with the correct token value:

platform:
  api_token: "cbom_tok_yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy"

Restart the service: sc stop "CBOM-WinCerts" && sc start "CBOM-WinCerts".

Error 3: Windows Service Fails to Start — Logon Failure

Error 1069: The service did not start due to a logon failure.

Cause: The password provided for the service account during sc create is incorrect, or the account password has been changed or expired since the service was registered.

Resolution:

Verify the service account password is correct in Active Directory or Local Users and Groups.
Update the service credentials using the Services snap-in (services.msc): - Right-click CBOM WinCerts Sensor and select Properties. - Go to the Log On tab. - Re-enter the correct password and click OK.

Alternatively, update via command line:

sc config "CBOM-WinCerts" obj= "CORP\svc-cbom-wincerts" password= "UpdatedPassword123!"

Start the service: sc start "CBOM-WinCerts".

10. Security Recommendations

Principle of least privilege: Grant the service account only Read access to certificate store ACLs and private key permissions. Do not add the account to local Administrators, Domain Admins, or any other privileged group.
Protect the configuration file: The sensor-config.yaml file contains the CBOM API token. Restrict file permissions so only the Administrators group and the service account can read it. Never store this file in a network share or world-readable location.
Rotate the API token regularly: Regenerate the CBOM platform API token on a scheduled basis (every 90 days or per your organization's secrets rotation policy). Update sensor-config.yaml and restart the service after each rotation.
Audit service account activity: Enable Windows Security Audit logging for the service account to track logon events and certificate store access. Monitor Event ID 4624 (successful logon) and 4625 (failed logon) for the svc-cbom-wincerts account.
Do not grant private key export permissions: When configuring Manage Private Keys ACLs on the MY store, assign only Read — never Full Control. This prevents the sensor account from being used to export or delete private keys if the account is ever compromised.

11. Conclusion

The CBOM Discover_WinCerts sensor provides continuous, read-only visibility into cryptographic certificates stored across all Windows Local Machine certificate stores, enabling organizations to maintain an accurate Cryptographic Bill of Materials for their Windows infrastructure. By following this guide, a least-privilege service account is created, scoped permissions are applied to certificate store and private key ACLs, and the sensor is deployed as a managed Windows service or scheduled task. Once operational, the sensor feeds certificate metadata — including key algorithms, validity periods, subject and issuer details, and chain information — directly into the CBOM platform for centralized cryptographic asset management and compliance reporting.

CBOM Secure

Windows Certificate Stores Setup Guide for CBOM WinCerts Sensor

1. Purpose

2. Prerequisites

3. Create a Dedicated Service Account

3.1 Create a Domain Service Account (Active Directory)

3.2 Create a Local Service Account (Non-Domain Machine)

4. Grant Read Access to the Windows Certificate Stores

4.1 Grant Access to the MY (Personal) Store Private Keys

4.2 Grant Read Access to Other Certificate Stores

4.3 Grant Log On as a Service Right

5. Install the CBOM Sensor on the Target Machine

6. Configure CBOM Sensor

7. Deploy the Sensor as a Windows Service

7.1 Alternative: Deploy as a Scheduled Task

8. Validation

8.1 Verify Certificate Store Access with certutil

8.2 Verify Sensor Logs

8.3 Confirm Discovery in CBOM Platform

9. Common Errors and Resolution

Error 1: Access Denied Opening the MY Certificate Store

Error 2: Sensor Fails to Submit Report — HTTP 401 Unauthorized

Error 3: Windows Service Fails to Start — Logon Failure

10. Security Recommendations

11. Conclusion

On this Page: