I am trying to create a Windows server with an IIS server that has a web site with client certificate authentication. The client certificates are signed by our own root CA. Because of that we must import that CA into the Trusted Root Authorities at the server. I can successfully import the cert and sometimes the first request to the server succeeds. Unfortunately Windows deletes the CA certs quite quickly and after that the request to the server start failing with 403 errors. I've found the following in the Event Viewer:

Successful auto delete of third-party root certificate:: Subject: Sha1 thumbprint: <"The thumbprint of our cert">.

How do I make Windows stop doing this? The server is running on Amazon EC2 and we want to avoid using a custom AMI. I therefore need to be able to disable this using a script (preferably PowerShell).

  • Did you search for this error message at all? A quick search reveals a number of different solutions. Which ones have you tried already?
    – devicenull
    Commented Jul 28, 2013 at 1:20
  • Yes, I searched for it. However, I only found solutions where you changed the setting using some Windows UI. As you can see from my question, I must be able to script it. Did you find any solution involving a script?
    – Yrlec
    Commented Jul 28, 2013 at 16:36

1 Answer 1


You should be able to set the relevant group policy setting (Turn off Automatic Root Certificate Updates) via scripting by using the LOCALGPO command found here or by setting the registry value directly:

Key:   HKLM\Software\Policies\Microsoft\SystemCertificates\AuthRoot\
Name:  DisableRootAutoUpdate
Value: 1 
  • 3
    This solution disables Windows automatic Root Certificates updates completely. That sounds like a bad idea to me. Is there a way to tell Windows to leave a particular root CA alone, rather than disabling the feature altogether?
    – richb
    Commented Feb 24, 2014 at 4:26
  • 1
    @richb, typically you would not need to do this sort of mod. Third-party certs are specifically separated so they can be maintained automatically. If you are adding your own CA, use "Trusted Root Certificate Authorities" and it will not get removed by updates.
    – Mitch
    Commented Feb 24, 2014 at 4:39
  • Mitch: Thanks for the reply. I am installing my CA in "Trusted Root Certificate Authorities". It works for a few days, then Windows deletes it.
    – richb
    Commented Feb 24, 2014 at 5:08
  • 2
    Yes it is valid. The problem is Windows deletes it from Trusted Root Certificate Authorities every few days. I thought that was the point of the original question: "Preventing Windows from deleting our root CA". I can set DisableRootAutoUpdate but I don't want to. I want to mark just one root CA (which I created with makecert) as valid permanently, without setting DisableRootAutoUpdate.
    – richb
    Commented Feb 24, 2014 at 5:33
  • 1
    @richb, can you post the makecert command you are using, or a copy of the certificate? Such a deletion should not be happening.
    – Mitch
    Commented Feb 24, 2014 at 5:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .