I used CryptoGuy's code, expanded upon it significantly, and turned it into a function. It still has room for improvement, however. Thanks, CryptoGuy!
function Get-KeyContainer {
[CmdletBinding()]
Param([Parameter(Position=0, Mandatory=$true, ValueFromPipeline=$true)] [string]$Thumbprint,
[Parameter(Position=1, Mandatory=$false, ValueFromPipeline=$false)] [switch]$MachineStore)
$MemberDefinition=@"
[DllImport("Crypt32.dll", SetLastError = true, CharSet = CharSet.Auto)]
public static extern bool CertGetCertificateContextProperty(
IntPtr pCertContext,
uint dwPropId,
IntPtr pvData,
ref uint pcbData);
[StructLayout(LayoutKind.Sequential, CharSet=CharSet.Unicode)]
public struct CRYPT_KEY_PROV_INFO {
[MarshalAs(UnmanagedType.LPWStr)] public string pwszContainerName;
[MarshalAs(UnmanagedType.LPWStr)] public string pwszProvName;
public uint dwProvType;
public uint dwFlags;
public uint cProvParam;
public IntPtr rgProvParam;
public uint dwKeySpec;}
[DllImport("ncrypt.dll", SetLastError = true)]
public static extern int NCryptOpenStorageProvider(
ref IntPtr phProvider,
[MarshalAs(UnmanagedType.LPWStr)] string pszProviderName,
uint dwFlags);
[DllImport("ncrypt.dll", SetLastError = true)]
public static extern int NCryptOpenKey(
IntPtr hProvider,
ref IntPtr phKey,
[MarshalAs(UnmanagedType.LPWStr)] string pszKeyName,
uint dwLegacyKeySpec,
uint dwFlags);
[DllImport("ncrypt.dll", SetLastError = true)]
public static extern int NCryptGetProperty(
IntPtr hObject,
[MarshalAs(UnmanagedType.LPWStr)] string pszProperty,
byte[] pbOutput,
int cbOutput,
ref int pcbResult,
int dwFlags);
[DllImport("ncrypt.dll", CharSet=CharSet.Auto, SetLastError=true)]
public static extern int NCryptFreeObject(IntPtr hObject);
"@
Add-Type -MemberDefinition $MemberDefinition -Namespace PKI -Name Tools
$CERT_KEY_PROV_INFO_PROP_ID = 0x2 # from Wincrypt.h header file
# from Ncrypt.h header file
if ($MachineStore.IsPresent) { $NCRYPT_MACHINE_KEY_FLAG = 0x20 }
else { $NCRYPT_MACHINE_KEY_FLAG = 0 }
$cert=Get-Item -Path ("Cert:\LocalMachine\My\"+$Thumbprint)
$pcbData = 0
$result=[PKI.Tools]::CertGetCertificateContextProperty($cert.Handle,$CERT_KEY_PROV_INFO_PROP_ID,[IntPtr]::Zero,[ref]$pcbData)
if ($result -ne $true) {
switch ($result) {
-2146885628 { Write-Error "ERROR: CRYPT_E_NOT_FOUND 0x80092004 (-2146885628)`r`nThe certificate does not have the specified property." }
-2005270525 { Write-Error "ERROR: ERROR_MORE_DATA 0x887A0003 (-2005270525)`r`nIf the buffer specified by the pvData parameter is not large enough to hold the returned data, the function sets the ERROR_MORE_DATA code and stores the required buffer size, in bytes, in the variable pointed to by pcbData." }
}
exit
}
$pvData = [Runtime.InteropServices.Marshal]::AllocHGlobal($pcbData)
$result=[PKI.Tools]::CertGetCertificateContextProperty($cert.Handle,$CERT_KEY_PROV_INFO_PROP_ID,$pvData,[ref]$pcbData)
if ($result -ne $true) {
switch ($result) {
-2146885628 { Write-Error "ERROR: CRYPT_E_NOT_FOUND 0x80092004 (-2146885628)`r`nThe certificate does not have the specified property." }
-2005270525 { Write-Error "ERROR: ERROR_MORE_DATA 0x887A0003 (-2005270525)`r`nIf the buffer specified by the pvData parameter is not large enough to hold the returned data, the function sets the ERROR_MORE_DATA code and stores the required buffer size, in bytes, in the variable pointed to by pcbData." }
}
exit
}
$keyProv = [Runtime.InteropServices.Marshal]::PtrToStructure($pvData,[type][PKI.Tools+CRYPT_KEY_PROV_INFO])
[Runtime.InteropServices.Marshal]::FreeHGlobal($pvData)
$phProvider = [IntPtr]::Zero
$result=[PKI.Tools]::NCryptOpenStorageProvider([ref]$phProvider,$keyProv.pwszProvName,0)
if ($result -ne 0) {
switch ($result) {
-2146893815 { Write-Error "ERROR: NTE_BAD_FLAGS 0x80090009 (-2146893815)`r`nInvalid flags specified" }
-2146893785 { Write-Error "ERROR: NTE_INVALID_PARAMETER 0x80090027 (-2146893785)`r`nThe parameter is incorrect" }
-2146893810 { Write-Error "ERROR: NTE_NO_MEMORY 0x8009000E (-2146893810)`r`nInsufficient memory available for the operation" }
}
exit
}
$phKey = [IntPtr]::Zero
$result=[PKI.Tools]::NCryptOpenKey($phProvider,[ref]$phKey,$keyProv.pwszContainerName,0,$NCRYPT_MACHINE_KEY_FLAG)
if ($result -ne 0) {
switch ($result) {
-2146893815 { Write-Error "ERROR: NTE_BAD_FLAGS 0x80090009 (-2146893815)`r`nThe dwFlags parameter contains a value that is not valid." }
-2146893802 { Write-Error "ERROR: NTE_BAD_KEYSET 0x80090016 (-2146893802)`r`nThe specified key was not found. Try using the -MachineKey flag to look in the Machine's store instead of the User's store." }
-2146893786 { Write-Error "ERROR: NTE_INVALID_HANDLE 0x80090026 (-2146893786)`r`nThe hProvider parameter is not valid." }
-2146893785 { Write-Error "ERROR: NTE_INVALID_PARAMETER 0x80090027 (-2146893785)`r`nThe parameter is incorrect" }
-2146893810 { Write-Error "ERROR: NTE_NO_MEMORY 0x8009000E (-2146893810)`r`nInsufficient memory available for the operation" }
}
exit
}
$pcbResult = 0
$result=[PKI.Tools]::NCryptGetProperty($phKey,"Unique Name",$null,0,[ref]$pcbResult,0)
if ($result -ne 0) {
switch ($result) {
-2146893815 { Write-Error "ERROR: NTE_BAD_FLAGS 0x80090009 (-2146893815)`r`nThe dwFlags parameter contains a value that is not valid." }
-2146893786 { Write-Error "ERROR: NTE_INVALID_HANDLE 0x80090026 (-2146893786)`r`nThe hProvider parameter is not valid." }
-2146893785 { Write-Error "ERROR: NTE_INVALID_PARAMETER 0x80090027 (-2146893785)`r`nThe parameter is incorrect" }
-2146893810 { Write-Error "ERROR: NTE_NO_MEMORY 0x8009000E (-2146893810)`r`nInsufficient memory available for the operation" }
-2146893783 { Write-Error "ERROR: NTE_NOT_SUPPORTED 0x80090029 (-2146893783)`r`nThe specified property is not supported for the object." }
}
exit
}
$pbOutput = New-Object byte[] -ArgumentList $pcbResult
$result=[PKI.Tools]::NCryptGetProperty($phKey,"Unique Name",$pbOutput,$pbOutput.length,[ref]$pcbResult,0)
if ($result -ne 0) {
switch ($result) {
-2146893815 { Write-Error "ERROR: NTE_BAD_FLAGS 0x80090009 (-2146893815)`r`nThe dwFlags parameter contains a value that is not valid." }
-2146893786 { Write-Error "ERROR: NTE_INVALID_HANDLE 0x80090026 (-2146893786)`r`nThe hProvider parameter is not valid." }
-2146893785 { Write-Error "ERROR: NTE_INVALID_PARAMETER 0x80090027 (-2146893785)`r`nThe parameter is incorrect" }
-2146893810 { Write-Error "ERROR: NTE_NO_MEMORY 0x8009000E (-2146893810)`r`nInsufficient memory available for the operation" }
-2146893783 { Write-Error "ERROR: NTE_NOT_SUPPORTED 0x80090029 (-2146893783)`r`nThe specified property is not supported for the object." }
}
exit
}
[Text.Encoding]::Unicode.GetString($pbOutput)
$result=[PKI.Tools]::NCryptFreeObject($phProvider)
if ($result -ne 0) { Write-Error "ERROR: NTE_INVALID_HANDLE 0x80090026 (-2146893786)`r`nThe hProvider parameter is not valid."; exit }
[void][PKI.Tools]::NCryptFreeObject($phKey)
if ($result -ne 0) { Write-Error "ERROR: NTE_INVALID_HANDLE 0x80090026 (-2146893786)`r`nThe hProvider parameter is not valid."; exit }
}
Get-KeyContainer -Thumbprint "xxxxxxxxx" -MachineStore
