what's the difference b/w MMC.exe and certmgr.msc

Question

can anyone explain what's the difference b/w MMC.exe and certmgr.msc? MMC's file-> snap in functionality seems weird. some certificates appear in MMC when we select computer account from add/remove snap in but they do not appear in certmgr.

Solution 1

Certmgr.msc is an MMC snap-in. MMC is simply the windows GUI shell for most administrative and even some non-administrative snap-ins. Snap-ins load different functionality to work with different parts of the system or network. You can create custom MMC views that load multiple snap-ins at once. If certmgr.msc is displaying different results than when you load the MMC window it is most likely not pointing or loading from the same location.

More about MMC with references: http://en.wikipedia.org/wiki/Microsoft_Management_Console

Here's an existing SuperUser post that talks about changing the certmgr.msc container: https://superuser.com/questions/249484/how-can-i-start-certmgr-msc-for-computer-account

Solution 2

MMC.exe is the host process to certmgr.msc. So comparing the two is wrong the wrong way to look at it already :)

What happens here is that there are two sides to the certificate store on Windows. One is the system-global store, the user is user-specific. certmgr.msc unless reconfigured always shows you the current user's certificate store (checked in Windows 7). This is also shown in the caption bar of window.

So the difference here is natural because they are two different collections of certificates. Depending on the system there can be an overlap, but usually that is minimal.

Let's say you'd be installing an SSL (server) certificate then usually that would go to the system store, while those root certificates for your browser would go to the user-specific store.

This is more visible when you do code-signing, where you have to specify the store when you sign the program.