Get-ChildItem Cert:\ issue with PowerShell Script

Question

I have an interesting issue with a PowerShell script I'm working on that sends an email to our group to let us know when a certificate on a server is about to expire. From the command line, each line of code works perfectly, but when the script runs, the $bodyMid variable isn't returning the results of the Get-ChildItem command.

Code:

# Extract information from Server Event Logs
$eventLog = Get-EventLog -LogName Application -EntryType Warning -Newest 1 -Source AutoEnrollment | Select EventID, MachineName, EntryType, Source, Message
$eventString = Out-String -InputObject $eventLog
$msgLength = $eventString.length
Write-Host "Length:" $msgLength
Write-Host "Message Body: " $eventString

# Extract the Thumbprint from the Certificate from the Event Logs
$thumbPrint = $eventString.Substring([int]$msgLength-69,69)
Write-Host "Thumbprint String: " $thumbPrint
$thumbPrint = $thumbPrint.Replace(" ", "")
$thumbPrint = $thumbPrint.Replace("'", "")
Write-Host "Processed Thumbprint: " $thumbPrint

# Extract the Certificate information from the Server
$certInfo = Get-ChildItem Cert:\ -Recurse | Where { $_.Thumbprint -eq $thumbPrint} | Select FriendlyName, Thumbprint, DnsNameList, PSPath, NotBefore, NotAfter
$bodyMid = Out-String -InputObject $certInfo
$bodyCount = $bodyMid.length
Write-Host "Mid-Body Count: " $bodyCount
Write-Host "Mid-Body: " $bodyMid

When it runs, this is the result:

PS C:\Scripts> .\ServiceNotify.ps1
Length: 543
Message Body:

EventID     : 64
MachineName : ADFS-01.contoso.com
EntryType   : Warning
Source      : AutoEnrollment
Message     : The description for Event ID '-2147483584' in Source 'AutoEnrollment' cannot be found.  The local computer may not have the
              necessary registry information or message DLL files to display the message, or you may not have permission to access them.
              The following information is part of the event:'local system', '81 4d 26 bb ef 94 30 25 32 44 e1 c7 bb 51 92 79 8b c6 5d 29'

Thumbprint String:  '81 4d 26 bb ef 94 30 25 32 44 e1 c7 bb 51 92 79 8b c6 5d 29'

Processed Thumbprint:  814d26bbef9430253244e1c7bb5192798bc65d29

Mid-Body Count:  0
Mid-Body:

But when I assign the variables outside the script and just run them line for line inside of PowerShell, it works as it should:

PS C:\Scripts> $thumbPrint = "814D26BBEF9430253244E1C7BB5192798BC65D29"
PS C:\Scripts> $certInfo = Get-ChildItem Cert:\ -Recurse | Where { $_.Thumbprint -eq $thumbPrint} | Select FriendlyName, Thumbprint, DnsName
List, PSPath, NotBefore, NotAfter
PS C:\Scripts> $bodyMid = Out-String -InputObject $certInfo
PS C:\Scripts> $bodyCount = $bodyMid.length
PS C:\Scripts> Write-Host "Mid-Body Count: " $bodyCount
Mid-Body Count:  352
PS C:\Scripts> Write-Host "Mid-Body: " $bodyMid
Mid-Body:

FriendlyName : DC-WC-Cert-2016-2019
Thumbprint   : 814D26BBEF9430253244E1C7BB5192798BC65D29
DnsNameList  : {*.contoso.com, contoso.com}
PSPath       : Microsoft.PowerShell.Security\Certificate::LocalMachine\My\814D26BBEF9430253244E1C7BB5192798BC65D29
NotBefore    : 3/4/2016 11:00:00 AM
NotAfter     : 6/4/2019 9:59:59 AM

I wouldn't be against doing this a different way, but I'm trying to understand why the cmdlet isn't working inside the script like I expect it to. Any suggestions? Thanks!

Answer 1

Thanks for the input; I figured out how to work around it. The thumbprint had other hidden characters that were being returned, which I could see using Notepad++ to view the output when it was dumped to a text file. To resolve the issue, the easiest way was to just keep the thumbprint and drop the rest, accomplished by the following adjustments to the script:

# Extract the Thumbprint from the Certificate from the Event Logs
$thumbPrintString = $eventString.Substring([int]$msgLength-69,69)
Write-Host "Thumbprint String: " $thumbPrintString
$thumbPrintString = $thumbPrintString.Replace(" ", "")
$thumbPrintString = $thumbPrintString.Replace("'", "")
$thumbPrintString = $thumbPrintString.Replace("`n", "")
$thumbPrintLength = $thumbPrintString.length
$thumbPrint = $thumbPrintString.Substring(0,40)

The result gave me a clean thumbprint, which then gave me the desired output when running the Get-ChildItem Cert:\\ -Recurse command. It now sends out a formatted email that list the cert that is about to expire:

The following event has triggered on ADFS-01: 
 ---------------------------------------------- 

FriendlyName : DC-WC-Cert-2016-2019
Thumbprint   : 814D26BBEF9430253244E1C7BB5192798BC65D29
DnsNameList  : {*.contoso.com, contoso.com}
PSPath       : Microsoft.PowerShell.Security\Certificate::LocalMachine\My\814D26BBEF9430253244E1C7BB5192798BC65D29
NotBefore    : 3/4/2016 11:00:00 AM
NotAfter     : 6/4/2019 9:59:59 AM

Please look into this issue as soon as possible. This task will repeat ever 12 hours until resolved.