How do I: Delete old Certificates windows servers using Powershell (Azure Classic Release Pipelines)

How do I: Delete old Certificates windows servers using Power Shell (Azure Classic Release Pipelines)

Tried this code and I get:

2024-05-07T02:43:20.4279860Z ##[error]Atleast one remote job failed. Consult logs 
for more details. ErrorCodes(s): 
'RemoteDeployer_NonZeroExitCode***RemoteDeployer_NonZeroExitCode***RemoteDeployer_NonZeroEx 
      itCode***RemoteDeployer_NonZeroExitCode' 

param(
    $servers = "$(deploy-Hostesses)"
)

# 
  foreach ($server in $servers) {
    Write-Host "Processing server: $server"

    
    Invoke-Command -ComputerName $server -ScriptBlock {
        # Retrieve all certificates from the certificate store
        $certs = Get-ChildItem -Path Cert:\LocalMachine\My
        
        # Define the date threshold (current date minus expiration days)
        $thresholdDate = (Get-Date).AddDays(-120)  
        
        
        foreach ($cert in $certs) {
            # Check if the certificate is expired
            if ($cert.NotAfter -lt $thresholdDate) {
                Write-Host "Certificate $($cert.Thumbprint) is expired. Deleting..."
                # Delete the expired certificate
                Remove-Item -Path "Cert:\LocalMachine\My\$($cert.Thumbprint)" -Force
                Write-Host "Certificate $($cert.Thumbprint) deleted."
            }
        }
    }
}

Ideas on what I am missing? Windows server 2019 Psremoteing enabled

Update.. Using the code below and realizing I was using the inline code but on powershell on target machines:

# Get the current date
$currentDate = Get-Date

# Define the date threshold (120 days ago)
$thresholdDate = $currentDate.AddDays(-30)

# Retrieve all certificates from the certificate store
$certs = Get-ChildItem -Path $CertStore

foreach ($cert in $certs) {
    # Check if the certificate is expired (NotAfter date is older than the threshold date)
    if ($cert.NotAfter -lt $thresholdDate) {
        Write-Output "Certificate $($cert.Thumbprint) is expired. Deleting..."
        # Delete the expired certificate
        Remove-Item -Path $cert.PSPath -Force
        Write-Output "Certificate $($cert.Thumbprint) deleted."
    }
}

Slightly change the script as below, it works on my side.

function ProcessServers {
param(
    $servers = "wadeVM1,wadeVM2"    # the server list
)

# Split the servers string into an array
$servers = $servers.Split(',')

# 
  foreach ($server in $servers) {
    Write-Host "Processing server: $server"

    
    Invoke-Command -ComputerName $server -ScriptBlock {
        # Retrieve all certificates from the certificate store
        $certs = Get-ChildItem -Path Cert:\LocalMachine\My
        
        # Define the date threshold (current date minus expiration days)
        $thresholdDate = (Get-Date).AddDays(-120)  
        
        
        foreach ($cert in $certs) {
            # Check if the certificate is expired
            if ($cert.NotAfter -lt $thresholdDate) {
                Write-Host "Certificate $($cert.Thumbprint) is expired. Deleting..."
                # Delete the expired certificate
                Remove-Item -Path "Cert:\LocalMachine\My\$($cert.Thumbprint)" -Force
                Write-Host "Certificate $($cert.Thumbprint) deleted."
            }
        }
    }
}
}
ProcessServers             # run the function

I used inline script type for powershell task in classic pipeline:

Please follow below items for a check:

1. The server in the server list can be reached on your agent. Simply ping servername on the agent machine to validate. If it's not reached, add map in hosts and flush dns(ipconfig /flushdns).

2. on each server, run winrm quickconfig to configure the service. run winrm set winrm/config/client '@{TrustedHosts="*"}' to trust the host.

If you encounter the message as below:

Configure LocalAccountTokenFilterPolicy to grant administrative rights remotely to local users.

run command:

New-ItemProperty -Name LocalAccountTokenFilterPolicy -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -PropertyType DWord -Value 1, and Restart-Service WinRM.

4. Check the user used to run the devops agent, you can add whoami in pipeline for confirmation, make sure the user has admin permission so that it can delete the cert. If not, reconfigure the agent with an admin user.

Hope it helps.