�
- Obtain the following files from�the CAPICOM SDK and Windows 2003,
������������ �save the in a new folder named "
RemoveCA":
�
���������������� Capicom.dll
���������������� Certadm.dll
���������������� Cerutil.exe
�
��� 2. Copy the text bellow to a new file, named "
login.bat":
�
�
Start of script
----------------------------------------------------------------------------------------------
�
cd\
md RemoveCA
copy %0\..\removeca.vbs c:\RemoveCA
copy %0\..\capicom.dll c:\RemoveCA
copy %0\..\certutil.exe c:\RemoveCA
copy %0\..\certadm.dll c:\RemoveCA
copy %0\..\remove.vbs c:\RemoveCA
�
cd RemoveCA
c:\windows\system32\regsvr32 capicom.dll /s
�
start /w c:\windows\system32\cscript remove.vbs
�
cd\
rd removeca /s /q
�
c:\windows\system32\regsvr32 -u capicom.dll /s
�
-----------------------------------------------------------------------------------------
End of script
�
�
��� 3. Copy the text bellow to a new file, named "
Remove.vbs":
�
Start of script
---------------------------------------------------------------------------------------------------------------------------------------
�
VerifyHostIsCScript
�
DIM Store, Certificate
Dim uPublicKey
Dim uEncodedData
Const CAPICOM_CERT_INFO_SUBJECT_SIMPLE_NAME������ = 0
Const CAPICOM_MEMORY_STORE����������������������� = 0
Const CAPICOM_LOCAL_MACHINE_STORE���������������� = 1
Const CAPICOM_CURRENT_USER_STORE����������������� = 2
Const CAPICOM_STORE_OPEN_READ_ONLY��������������� = 0
Const CAPICOM_STORE_OPEN_EXISTING_ONLY����������� = 128
Const PublicKeyInput="30 32 02 0a 02 82 02 01 02 ba b5 30 43 26 58 ce 55 6f a6 58 91 da 99 2b d9 1c 43 f6 11 fe 55 00 4d 55 e6 0a 8f f0 2c e0 0f 4d 45 22 7e ac e2 92 76 47 d5 d6 af 36 a8 16 28 3f ff ce 05 82 b0 cf 86 1e b3 67 c2 8c 4a 42 91 5f 0a 7b 5f ba b4 66 e1 f5 36 af 22 92 00 6e cf 60 bb 47 25 b5 bb e1 84 c6 45 30 61 8e 2f ec 18 49 c8 a1 6a d9 83 32 ac fd e8 ed 92 76 e6 25 01 3b 8f e6 fb 02 73 c3 2b cb 05 2e 97 53 20 9f 36 51 db 13 f3 35 85 fa 5b a9 c0 7b b1 1c f8 aa ec e8 1e 43 8f 14 0f 91 1f b8 04 1c bc 1a b8 96 fa 96 0e 60 ff d7 9b 52 c5 97 90 78 9c d7 ab f6 aa 9a 1b 0e e6 2b 55 b5 2d b9 45 d0 11 06 68 94 ad 72 1e 78 1d b9 9d 4f 01 c0 00 49 09 6b 6f a8 fa a3 87 a4 25 13 5b ff a1 e0 b2 d8 d4 17 64 e5 62 2a 47 28 4a 84 37 6d 3b cb 41 e2 7c fa a4 1d 53 aa e6 db 18 51 fd 51 b2 e9 41 81 e0 70 11 0c 07 51 14 8d 89 29 4b 65 2b 0d de 28 8c 41 e3 e0 03 d0 80 3f 91 ad 37 02 25 53 a8 b9 e8 b2 4f ed cb 66 35 fe 31 a5 a5 9e b2 01 28 c3 89 81 56 f1 a2 8e 33 0a c9 c5 0b 98 e2 5d fb 34 0e f4 5e 23 43 f1 0b 9b 17 a0 2c be 81 c7 85 99 4a 75 a5 81 50 34 db b1 09 35 35 b3 97 9d da 1d 5f 57 cf 6f e2 0b 43 a6 b9 58 65 f2 5a a1 1c ca 87 34 38 18 a3 27 64 94 78 f4 b2 51 41 76 ca de 3c 27 05 24 06 18 ba 40 e8 1a f3 47 42 22 8f ef 3f 20 e1 2d 91 af 32 4a a1 9e 40 87 2c ab 26 1f d3 60 39 41 e2 56 44 dd 35 cc 25 32 d5 2d 51 71 32 2d fd 1a 06 3b e1 d2 54 e6 ad 0a c4 31 af ea 6e 78 59 93 94 8e ca c8 e2 fe 78 3a 30 4e cc bc be eb e1 9d d7 1b 34 40 fc 95 04 88 5b e0 50 98 b7 92 47 bb ea 92 47 62 54 02 73 b6 2d 29 8f df 98 b3 63 df d1 36 dc 84 3e 4f a4 7f 2a 60 58 8e c2 eb 2f 3f b9 02 03 01 00 01"
Set Store = CreateObject("CAPICOM.Store")
Store.Open 1, "root", CAPICOM_STORE_OPEN_READ_ONLY
WScript.Echo "COMPUTER - TRUSTED ROOT CERTIFICATION AUTHORITIES (" & Store.Certificates.Count & " certs)"
For Each Certificate In Store.Certificates
��������������� 'If Certificate.isValid = 0 then
�������������������� 'WScript.Echo Certificate.Display
������������������������������ uPublicKey = Certificate.PublicKey.EncodedKey.Format(1)
������������������������������ if not strcomp(uPublicKey,PublicKeyInput,0) <> 0 Then
�
���������������������������������������������� WScript.Echo "I believe the certificate with name: " & Certificate.GetInfo(0) & " should be deleted"
���������������������������������������������� WScript.Echo "Serial Number - " & Certificate.SerialNumber
���������������������������������������������� WScript.Echo "PublicKey - " & uPublicKey
���������������������������������������������� WScript.Echo "This certificate matches the public key and will be delete"
���������������������������������������������� strKind = "root"
���������������������������������������������� strCert = "COMPUTER - TRUSTED ROOT"
���������������������������������������������� DelWrongCert Certificate.SerialNumber, strKind, strCert
������������������������������ end if
��������������� 'End IF
Next
�
�
�
Sub DelWrongCert(strSerial, strKind, strCert)
�'intMsg = MsgBox("Do you want to delete the following certificate's serial number: " & VbCrLf & strSerial, 292, "Delete wrong " & strCert & " certificate")
�'If intMsg = 6 Then
��Dim objShell : Set objShell = CreateObject("WScript.Shell")
��strRun = "certutil -delstore " & strKind & " " & strSerial
'wscript.echo strRun
��intRun = objShell.Run(strRun, 0, True)
��If intRun <> 0 Then
���WScript.Echo "Deletion failed !"
��End If
��Set objShell = Nothing
�'End If
End Sub
�
Sub VerifyHostIsCScript()��
��� If Not LCase(Mid(WScript.FullName, InstrRev(WScript.FullName, "\") + 1)) = "cscript.exe" Then
������� MsgBox "You should run this script using CScript." & VbCrLf & _
������������ "It can be achieved by :" & VbCrLf & _
������������ "1. Using ''CScript " & WScript.ScriptName & "''." & vbCrLf & _
������������ "2. Changing the default Windows Scripting Host" & VbCrLf & _
������������ "��� to CScript by running once ''CScript //H:CScript''."
������� WScript.Quit
��� End If
End Sub
�
�
---------------------------------------------------------------------------------------------------------------------------------------
End of script
�
�
- The "Const PublicKeyInput" constant represent the Certificate of the Certificate Authority
�
������������ �"
Public Key" hash value.
�
�
� 4. Copy the "
login.bat" and "
remove.vbs" file to the "
RemoveCA" folder.
�
� 5. Copy the "
RemoveCA" folder to one of your domain controllers:
�
����� C:\WINDOWS\SYSVOL\sysvol\<YourDomainName\Policies\{31B2F340-016D-11D2-94
�
��������� 5F-00C04FB984F9}\MACHINE\Scripts\Startup.
�
� 6. Wait for complete Active Directory replication.
�
� 7. Use GPMC to edit the "
Default Domain Policy":
������� and a new computer startup script:
�
������ "
Computer Configuration" -> "
Windows settings" -> "
Scripts" -> "
Startup".
������ When configuring the script policy, browse to the folder mention above
���������������
������� and point to the "
login.bat" file.
�
� 8. Wait for complete Active Directory replication.
�
� 9. After computer reboot, the old Certificate Authority will be removed.
�
�
�
Script Overview:�
��� a. Create a new folder in the user computer; "
C:\RemoveCA"
�
��� b.�It then copies 4 file to this folder: "
Capicom.dll", "
Certadm.dll",
������������ "
Cerutil.exe" and "
Remove.vbs".
�
��� c. Register the "
capicom.dll" and use the "
Certutil.exe" command to delete
�
������������� the old Certificate Authority
�
�� �d. .Unregister "
capicom.dll" and remove the "
C:\RemoveCA"
������������ folder.
�
�
�