Policy
Turn on root certificate propagation from smart card
Windows 11 25H2
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista
This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted. If you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card. Note: For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card. If you disable this policy setting then root certificates will not be propagated from the smart card.
Registry values
How enabled and disabled states update the registry.
| Registry location | Type | Enabled value | Disabled value |
|---|---|---|---|
| HKLM\SOFTWARE\Policies\Microsoft\Windows\CertProp\EnableRootCertificatePropagation | REG_DWORD | 1 | 0 |
Policy elements
Inputs and configuration options exposed by this policy.
This policy has no additional user input fields.
Other policies in this category
Explore related policies at the same level.
- ComputerAllow certificates with no extended key usage certificate attributeAt least Windows Vista
- ComputerAllow ECC certificates to be used for logon and authenticationAt least Windows Server 2008 R2 or Windows 7
- ComputerAllow Integrated Unblock screen to be displayed at the time of logonAt least Windows Vista
- ComputerAllow signature keys valid for LogonAt least Windows Vista
- ComputerAllow time invalid certificatesAt least Windows Vista
- ComputerAllow user name hintAt least Windows Vista
- ComputerConfigure root certificate clean upAt least Windows Vista
- ComputerDisplay string when smart card is blockedAt least Windows Vista
- ComputerFilter duplicate logon certificatesAt least Windows Vista
- ComputerForce the reading of all certificates from the smart cardAt least Windows Vista
- ComputerNotify user of successful smart card driver installationAt least Windows Server 2008 R2 or Windows 7
- ComputerPrevent plaintext PINs from being returned by Credential ManagerAt least Windows Vista Service Pack 1