Get-SqlCertRenewalJob

This is the inventory: which certificates are on an automatic renewal schedule, on which scheduler, and how the last run went. It’s the answer to “are all our certificates covered by a renewal job?” — a one-command roll call, no changes, no cost.

Reads the spec store. With -JobId, returns that one; otherwise all. For each job it returns the key spec fields (CertType, ThresholdDays, Scheduler, CreatedUtc) plus the most recent run-log line. Offline and read-only — it does not contact any server; use Test-SqlCertRenewalJob for a live “would it renew now” check.

Recipe 01 — All renewal jobs and their last run

Get-SqlCertRenewalJob | Format-Table JobId, CertType, Scheduler, @{n='LastRun';e={$_.LastRun.Status}}

Recipe 02 — One job in detail

Get-SqlCertRenewalJob -JobId sql01-engine

This lists the renewal jobs you’ve set up — like a table of contents for automatic renewals. For each, you see what it renews, which scheduler runs it, and how the last run turned out. It only reads local files, so it’s instant and safe.

• A coverage report for certificate renewal — an auditor can confirm every certificate that should auto-renew has a job, and see each job’s last outcome.
• Offline and read-only, so it’s safe to run anywhere and reflects exactly what’s registered locally.