windows certificate store scan

Hey @mnagel, I think I found the issue. Your if statement in the collection script checks to see if $TargetUser matches "wmi.user". Unfortunately, tokens behave differently in collection than AD. In AD, a nonexistent property will return the token name. In a collection script, a nonexistent property will return a blank string. I think if you change your collection script to match on "" for user and pass, it will work.

I'll talk to the collector team about how we might be able to fix this and make things consistent.