Policy
Configure root certificate clean up
Microsoft Windows
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista
This policy setting allows you to manage the clean up behavior of root certificates. If you enable this policy setting then root certificate cleanup will occur according to the option selected. If you disable or do not configure this setting then root certificate clean up will occur on log off.
Internal name
CertPropRootCleanupString
Policy ID
54d3f7f746ed
Elements
1
Registry values
How enabled and disabled states update the registry.
No explicit registry values are set for enabled or disabled states.
Policy elements
Inputs and configuration options exposed by this policy.
| Scope | Element | Type | Registry mapping | Constraints & behavior | Copy |
|---|---|---|---|---|---|
| Computer | Root certificate clean up options ID RootCertCleanupOption_Levels | enum | Path SOFTWARE\Policies\Microsoft\Windows\CertProp Value name RootCertificateCleanupOption Type REG_DWORD | Options: No cleanup (0), Clean up certificates on smart card removal (1), Clean up certificates on log off (2) |
Root certificate clean up options
Registry mapping
Path
SOFTWARE\Policies\Microsoft\Windows\CertProp
Value name
RootCertificateCleanupOption
Type
REG_DWORD
Details
Options: No cleanup (0), Clean up certificates on smart card removal (1), Clean up certificates on log off (2)