Active Directory Certificate Services

Finding certificates in the Database

Find certificates according to the template:

certutil -view -restrict "CertificateTemplate=<TEMPLATE OID>" -out RequestID,NotAfter

Find certificates issued after a specific date:

certutil -view -restrict "notBefore>=01/10/2025" -out "RequestId,notBefore,NotAfter"

Deleting Failed Requests from the Database

Delete all the failed requests that were submitted before the 01 Jan 2026:

certutil -deleterow 01/01/2026 Request

The output will show the number or rows, or objects, that were deleted.

When there are multiples (i.e. millions) of certificates then use a batch script with the error code:

@echo off
:Top
certutil -deleterow /01/01/2026 Request
If %ERRORLEVEL% EQU -939523027 goto Top

Other ADCS Database mainentence

See - dropbox "certutil - databae maintenance"