Filter duplicate logon certificates

Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista

This policy settings lets you configure if all your valid logon certificates are displayed. During the certificate renewal period, a user can have multiple valid logon certificates issued from the same certificate template. This can cause confusion as to which certificate to select for logon. The common case for this behavior is when a certificate is renewed and the old one has not yet expired. Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (determined by their UPN). If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the the certificate with the expiration time furthest in the future will be shown. Note: This setting will be applied after the following policy: "Allow time invalid certificates" If you enable or do not configure this policy setting, filtering will take place. If you disable this policy setting, no filtering will take place.

This policy has no additional user input fields.

• Computer
  Allow certificates with no extended key usage certificate attribute

  At least Windows Vista
• Computer
  Allow ECC certificates to be used for logon and authentication

  At least Windows Server 2008 R2 or Windows 7
• Computer
  Allow Integrated Unblock screen to be displayed at the time of logon

  At least Windows Vista
• Computer
  Allow signature keys valid for Logon

  At least Windows Vista
• Computer
  Allow time invalid certificates

  At least Windows Vista
• Computer
  Allow user name hint

  At least Windows Vista
• Computer
  Configure root certificate clean up

  At least Windows Vista
• Computer
  Display string when smart card is blocked

  At least Windows Vista
• Computer
  Force the reading of all certificates from the smart card

  At least Windows Vista
• Computer
  Notify user of successful smart card driver installation

  At least Windows Server 2008 R2 or Windows 7
• Computer
  Prevent plaintext PINs from being returned by Credential Manager

  At least Windows Vista Service Pack 1
• Computer
  Reverse the subject name stored in a certificate when displaying

  At least Windows Vista