title: Filtering Certutil.exe output for non-autoenrolling certificates
body: <p>I'm using <a href="http://www.tinyint.com/index.php/2010/08/09/ca-certificate-expiration-monitoring/" rel="nofollow">a script by Tom Nolan</a> to query our CA for expiring certificates. However, I tried to no avail to filter the output for non-autoenrolling certificates, as these are the only ones of interest. That's the line in question:</p>
  
  <pre><code>certutil -view -restrict "NotAfter&gt;=$d1,NotAfter&lt;=$d2" -out "Request ID, Request Submission Date, Request Common Name, Requester Name, Request Email Address, Request Distinguished Name, CertificateTemplate, NotAfter" -config "$caServer\$caName"
  </code></pre>
  
  <p>I tried narrowing down the -restrict parameter like this:</p>
  
  <pre><code>-restrict "NotAfter&gt;=$d1,NotAfter&lt;=$d2,EnrollmentFlags&amp;&amp;0x20"
  </code></pre>
  
  <p>but had no success.</p>
  
  <p>Does anyone know how to achieve this?</p>
  
  <p>Thanks for your help!</p>