Help and Remove-StoredCredential Issues

[echalone]

Issues reported by @RHDHV-simon-sutcliffe on 2023-11-29:

1. Typo in the help

Running this command get-help remove-storedcredential -full

In this part of the returned info I spotted a duplicate value

-Type
Specifies the type of credential to be deleted, possible values are [Generic, DomainPassword, DomainCertificate,
DomainVisiblePassword, DomainCertificate, DomainExtended, Maximum, MaximumEx]

2. Issue with deleting a targeted DomainCertificate.

Using the command Get-StoredCredential -AsCredentialObject

It returns lots of information but I have included here the interesting ones.

Flags : 1
Type : DomainPassword
TargetName : Domain:target=*Session
Comment :
LastWritten : 29/11/2023 14:22:06
PaswordSize : 0
Password :
SecurePassword :
Persist : Session
AttributeCount : 0
Attributes : 0
TargetAlias :
UserName :

Flags : 129
Type : DomainCertificate
TargetName : Domain:target=*Session
Comment :
LastWritten : 29/11/2023 14:22:06
PaswordSize : 0
Password :
SecurePassword :
Persist : Session
AttributeCount : 0
Attributes : 0
TargetAlias :
UserName :&&&&&&&&&&&&&&&&&&&&&&&& (Changed this to protect the innocent)

Running this command Remove-StoredCredential -Type "DomainPassword" -target "Domain:target=*Session"

This correctly deletes only this entry

Flags : 1
Type : DomainPassword
TargetName : Domain:target=*Session
Comment :
LastWritten : 29/11/2023 14:22:06
PaswordSize : 0
Password :
SecurePassword :
Persist : Session
AttributeCount : 0
Attributes : 0
TargetAlias :
UserName :

However running this command Remove-StoredCredential -Type "DomainCertificate" -target "Domain:target=*Session"

This deleted both the above entries

[echalone]

Hey @RHDHV-simon-sutcliffe, thx for the report, I fixed the typo in the help but couldn't reproduce the delete issue. The Windows API is indeed a bit dumb and doesn't correctly filter for types if you only provide the type but no target filter (which is why the tool will then show you all the stored credentials instead of only those of a specific type). But I don't see any issue with what you reported when I try to reproduce it. I tried the following commands and it always gave me the right results, could you try with those commands too or tell me with what commands you can reproduce your issue if not with those? Thanks! (don't forget to replace the with whatever Get-StoredCredentials is showing you as the user for the certificate after you installed it via the GUI in your credential store.)

And thanks for letting me know the issue feature wasn't activated, I didn't even realize that ;)

### Add password first, delete password first
Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty

New-StoredCredential -Type DomainPassword -Target "123Session" -UserName "abc" -Password "abc" # create password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should now get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty

New-StoredCredential -Type DomainCertificate -Target "123Session" -UserName "<YourCertificateUserId>" -Password "" # create certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should now get us the new certificate

Remove-StoredCredential -Type "DomainPassword" -target "Domain:target=123Session" # remove password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should now be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should get us the new certificate

Remove-StoredCredential -Type "DomainCertificate" -target "Domain:target=123Session" # remove certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty



### Add password first, delete certificate first
New-StoredCredential -Type DomainPassword -Target "123Session" -UserName "abc" -Password "abc" # create password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should now get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty

New-StoredCredential -Type DomainCertificate -Target "123Session" -UserName "<YourCertificateUserId>" -Password "" # create certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should now get us the new certificate

Remove-StoredCredential -Type "DomainCertificate" -target "Domain:target=123Session" # remove certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty

Remove-StoredCredential -Type "DomainPassword" -target "Domain:target=123Session" # remove password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty



### Add certificate first, delete password first
Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty

New-StoredCredential -Type DomainCertificate -Target "123Session" -UserName "<YourCertificateUserId>" -Password "" # create certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should now get us the new certificate

New-StoredCredential -Type DomainPassword -Target "123Session" -UserName "abc" -Password "abc" # create password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should now get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should get us the new certificate

Remove-StoredCredential -Type "DomainPassword" -target "Domain:target=123Session" # remove password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should now be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should get us the new certificate

Remove-StoredCredential -Type "DomainCertificate" -target "Domain:target=123Session" # remove certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty



### Add certificate first, delete certificate first
New-StoredCredential -Type DomainCertificate -Target "123Session" -UserName "<YourCertificateUserId>" -Password "" # create certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should now get us the new certificate

New-StoredCredential -Type DomainPassword -Target "123Session" -UserName "abc" -Password "abc" # create password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should now get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should get us the new certificate

Remove-StoredCredential -Type "DomainCertificate" -target "Domain:target=123Session" # remove certificate

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should get us the new password
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty

Remove-StoredCredential -Type "DomainPassword" -target "Domain:target=123Session" # remove password

Get-StoredCredential -AsCredentialObject -Type DomainPassword -Target "123Session" # should be empty
Get-StoredCredential -AsCredentialObject -Type DomainCertificate -Target "123Session" # should be empty