Is it possible to put a certificate as trusted CA into Windows, given only physical access to system drive

Question

I have a physical access to HDD with "target" Widows 10 Pro installation. I can't login into this system as admin. I need to make the system trust my own CA. Is it possible to somehow put the certificate as trusted into windows while it's off, and then, when booted, have it trust that certificate?

I know Windows stores it's certificated in Registry. By looking into it, it seems like it is in REG_BINARY format, a blob of a certificate. I could load a system hive from the target disk via different windows installation that I am an admin off, and theoretically, I could put entries into it. The question is - do the blob for the same cert in registry differ from one Windows installation to another. Any hint on the matter would be much appreciated.

Additional info: The disk is not encrypted, I can modify files on it, I can see the Windows folder, and write to it.

Answer 1

You can do this. First, look at the certificate properties and locate the thumbprint value. For an example, let's look at an existing certificate which you can do this using the MMC Certificates snap-in:

Select Local Computer and then browse to the Trusted Certification Authorities section to view the certificates there:

Looking at the properties, locate the Thumbprint value:

Now, open Regedit.exe and navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates and find that thumbprint in the list:

Right-click that value and export it to a file. Next, mount the other hard drive and load the HKLM registry hive and import that value. The certificate should now be trusted.