CertCommand
Resources

What it takes to stand this up.

An hour of work on a domain you already run. This page covers the install order, what each machine needs, and which PowerShell versions are supported on the hosts you want to inventory.

Quickstart

Five steps, in this order.

The gMSA comes before the install because the installer registers the service under it. Everything after that can be done from the console.

  1. Create the gMSA

    Run the included gMSA script on a domain controller or an RSAT host, naming your domain, the app server, and the DNS host name the console will answer on. Reboot the app server so it picks up its new group membership, then run the standard Install-ADServiceAccount cmdlet on it. The service runs as this account and Active Directory manages its password.

  2. Install the console

    One Windows Server, either from the MSI or the install script. Both take the service account, the listen URL, and the AD group that gets the Operator role, then register the service with delayed auto start and recovery restart. There is no IIS to configure and no database server to provision. Data and logs live under %ProgramData%\CertCommand. For HTTPS, put a certificate in LocalMachine\My and pass its thumbprint.

  3. Roll out the JEA endpoint

    Run the fleet script once on a domain controller or RSAT host, pointing it at a target OU and your app server address. Run it with -WhatIf first and read what it plans to do. It stages the JEA files in SYSVOL, creates a GPO with hardened WinRM settings, a scoped firewall rule, and a scheduled task that registers the endpoint at startup and daily. No reboot is needed; it applies on the next policy refresh.

  4. Add your first assets

    Set an LDAP server in discovery settings and the Active Directory source starts filling the review queue with enabled server computer accounts. For anything that is not a domain member, add the host and port on the Assets page and CertCommand handshakes it directly. Accept what you want from the Discovery queue; nothing is contacted until you do.

  5. Set an alert rule

    Configure the mail relay and the webhook in Settings, each of which has a test button, then create a rule on the Alerts page. Give it a scope, day thresholds, recipients, and optional escalation recipients for the final threshold. Press p in the console to run a probe cycle immediately instead of waiting for the schedule.

System requirements

One server, one service account, WinRM.

Requirement Detail
App server One Windows Server. CertCommand is a self-contained Windows service on Kestrel, so there is no IIS role to add and no separate database server to run.
Service account A group managed service account. The included script creates it and grants the app server the right to retrieve its password.
Directory An Active Directory domain. Console sign-in uses Negotiate, meaning Kerberos with NTLM fallback, and the Viewer and Operator roles map to AD group SIDs.
Network WinRM reachable from the app server to the hosts you want to inventory, on TCP 5985 and 5986. The fleet GPO scopes the inbound rule to your app server addresses on the Domain profile only.
Storage The database and logs live under %ProgramData%\CertCommand. Warnings and errors also go to the Windows Event Log.
Internet access Not required. The console fetches nothing from a CDN and licensing is verified locally, so an isolated network is fully supported. Two optional features use outbound HTTPS: the daily update check, which one setting disables and which fails quietly when it cannot connect, and Certificate Transparency discovery, which ships turned off.
Browser Any current browser. The console is server-rendered with one small script file and Server-Sent Events for live updates, so there is no client framework to load.
Off-domain hosts Optional. A SYSTEM scheduled task running the collector script pushes inventory outbound over HTTPS to the ingest API using a key you set in the console.
PowerShell versions

Built for an estate that is not all one vintage.

One worker inventories mixed-version hosts. The collection script avoids 5.0-only syntax and falls back where it has to, so old servers still report.

Where Version
App server, running the worker Windows PowerShell 3.0 or later, or PowerShell 7. It detects Windows PowerShell first, then pwsh. To force PowerShell 7, set the executable in Settings under Remote.
Target hosts, JEA path (recommended) Windows PowerShell 5.0 or later, because JEA itself needs WMF 5.0. The installer refuses to register on older hosts and tells you to use the general shell instead.
Target hosts, general shell path Windows PowerShell 3.0 or later works fully. Windows PowerShell 2.0 hosts are best-effort only and are not a supported floor.
Off-domain collector Windows PowerShell 3.0 or later. It falls back to a raw HTTP request where Invoke-RestMethod is unavailable.

Each host's remote PowerShell version is recorded on its probe result and shown in that asset's probe log, so you can see what you are actually dealing with rather than what the inventory says you have.

Documentation

What ships with the build.

In the box

Administrator guide

Install, connect your estate, discovery sources, alert rules, access control, retention, and upgrade. Ships with the download rather than being gated behind a form.

In the box

GPO reference

Every registry value, firewall rule, and scheduled task the fleet script creates, written out so a policy admin can review it or reproduce it by hand.

Get the build

Request the evaluation build.

Binaries are not on public download yet. Email us and we will send the installer and the administrator guide. The 14-day evaluation starts from inside the console once it is running, with no key to enter and no target limit.

Email sales@certcommand.app What the evaluation includes