为什么SYSTEM帐户无法访问用户的证书存储？
同时，SYSTEM 帐户能够从智能卡读取证书（通过 CSP dll）并将其放入证书存储中（在本例中，winlogon.exe 使用 CSP，所以我猜 winlogon.exe 里面有一些魔力）。
例如，在系统帐户下调用 CertOpenSystemStore( NULL, L"MY" ) 会成功，但 CertFindCertificateInStore() 不会找到任何内容，因为看起来存储是空的。当我登录时，CertFindCertificateInStore() 将找到请求的证书。
Why the SYSTEM account is not able to access the user's certificate store?
At the same time the SYSTEM account is able to read the certificate (through the CSP dll) from the smart card and put it in the certificate store (CSP is being used by winlogon.exe in this case, so I guess the winlogon.exe has some magic inside).
For example, calling CertOpenSystemStore( NULL, L"MY" ) under system account will succeed, but CertFindCertificateInStore() will not find anything, because it looks like the store is empty. When I log on, the CertFindCertificateInStore() will find the requested certificate.
发布评论
评论（3）
每个用户都有不同的“我的商店”，因此如果您能够在用户 A 登录的“我的商店”中找到某些内容，您可能无法从用户 2 那里找到该内容。
尝试使用 MMC 访问其他用户和服务帐户的证书存储。
Every user has a different MY Store, So If you are able to find something in USER A login My Store, you might not be able to get that from User 2.
Try using MMC for accessing Certificate Stores of other users and service accounts.
感谢 Der_Meister！
完整命令行，从管理员命令提示符处执行：
psexec -s -ic:\windows\system32\mmc.exe c:\windows\system32\certmgr.msc
然后导入本地系统所需的证书。
就我而言，这是签名工具签署二进制文件所需的代码签名证书。 Signtool 由 gitlab-runner 服务执行。
Thanks to Der_Meister!
The full command line, to be executed from the administrator command prompt:
psexec -s -i c:\windows\system32\mmc.exe c:\windows\system32\certmgr.msc
Then import the certificate needed by the Local System.
In my case it was a code signing certificate required by the signtool to sign the binaries. Signtool was executed by gitlab-runner service.
您需要将相关证书放入系统证书存储中，或者需要模拟您想要访问其存储的用户。模拟可以通过多种方式完成，我建议开始查看 MSDN。
Either you need to put the relevant certificates in the SYSTEM cert store or you need to impersonate the user whose store you wish to access. Impersonation can be done in multiple ways, I would suggest start looking at MSDN.