@Victor Lyuboslavsky if you search

Manage computer certificates

in the Windows Start, it will give you the

Local Machine

list of stores. These are the stores that are shared with all users, except for the

Personal

one. Then you have

Manage user certificates

, these are the stores for the

Current User

, they should all inherit the

Local Machine

ones, except again for the

Personal

. This is what osquery would currently use if it was running, as a process, as the logged in user. Otherwise, you can check other users with: https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-view-certificates-with-the-mmc-snap-in