How to Use the certmgr and certutil Tools in Windows 11 to Audit and Remove Root Certificates

In Windows 11, cryptographic trust underpins every secure communication protocol—including HTTPS web browsing, Virtual Private Network (VPN) handshakes, secure code execution via Authenticode, and enterprise single sign-on (SSO). The operating system relies on the Windows Certificate Store to validate Public Key Infrastructure (PKI) digital certificates. If a malicious application, compromised proxy tool, or rogue enterprise management agent injects a fraudulent Root Certificate Authority (CA) into your trusted root store, an adversary can intercept encrypted network traffic (via Man-in-the-Middle attacks) and sign malicious executables without triggering operating system security warnings. Systems administrators and security professionals must regularly audit and sanitize these certificate stores using the native graphical snap-ins (certmgr.msc, certlm.msc) and command-line utilities (certutil.exe).

Understanding Windows Certificate Stores: User vs. Machine Scope

Windows 11 isolates certificate trust into two distinct administrative scopes, each containing specific logical stores. The table below delineates their security scopes and administrative requirements:

Certificate Store Scope	Management Interface	Security Authority Required	System-Wide Impact
Current User Store	certmgr.msc	Standard User permissions.	Governs encryption, client certificates, and user-specific S/MIME signatures.
Local Machine Store	certlm.msc	Elevated Administrator privileges.	Controls operating system trust across all local users, background services, and web browsers.
Trusted Root (Root)	certutil -store Root	System / Local Administrator.	Anchors trust; any intermediate CA signed by these roots is automatically validated.
Disallowed (Untrusted)	certutil -store Disallowed	System / Local Administrator.	Explicit blacklist; blocks revoked or fraudulent certificates regardless of chain validity.

Auditing Certificates Using the Graphical Snap-Ins

Windows provides two dedicated Microsoft Management Console (MMC) snap-ins for visual certificate inspection.

1. Launching the Local Machine Certificate Store

Because rogue root certificates pose the greatest threat when installed machine-wide, always inspect the Local Machine container:

1. Press Windows + R to open the Run dialogue box.
2. Type certlm.msc and press Ctrl + Shift + Enter to launch with elevated administrative privileges.
3. In the left console tree, expand Trusted Root Certification Authorities and click Certificates.
4. The central pane lists all anchor certificates trusted by the operating system.

2. Identifying Suspicious Root Certificates

Valid root certificates originate from established global certificate authorities (e.g., DigiCert, Sectigo, GlobalSign, Let’s Encrypt, Microsoft). Look out for:

• Self-Signed Adware Certificates: Names resembling proxy tools (e.g., FiddlerRoot, Charles Proxy, Superfish, or unverified VPN utilities).
• Internal Corporate CAs on Personal Rigs: Root certificates belonging to former employers or unknown domain controllers.
• Mismatched Expiration Dates: Root certificates with implausible validity periods (e.g., 50-year expirations) or unusual cryptographic hashing algorithms like SHA-1 or MD5.

3. Removing a Rogue Certificate via GUI

1. Right-click the suspicious certificate in the right pane.
2. Select Delete.
3. Confirm the deletion warning prompt. The certificate is immediately purged from the active crypto engine.

Command-Line Auditing and Removal with certutil

For automated enterprise compliance scans, headless servers, and rapid security response, the native command-line utility certutil.exe provides complete administrative control.

1. Querying the Trusted Root Store

Launch an elevated Command Prompt or PowerShell terminal (Run as Administrator). To dump an aggregated inventory of all certificates installed in the machine-level Root store:

certutil -store Root

To inspect a cleaner list displaying subject common names and serial numbers:

certutil -store Root | findstr /i "Issuer: Subject: Serial"

2. Deleting a Rogue Certificate by Serial Number or Hash

When an unauthorized certificate is identified, extract its Serial Number or SHA-1 Thumbprint from the query output. To remove it permanently from the machine-level Root store:

certutil -delstore Root "4e3a89b21f00a45c829e7104d"

Certutil confirms the deletion:

CertUtil: -delstore command completed successfully.

3. Adding a Flagged Certificate to the Disallowed (Blacklist) Store

If you suspect a rogue root certificate might be re-injected by background malware or stubborn software installers, export the certificate (e.g., malicious_ca.cer) and add it directly to the Disallowed store:

certutil -addstore Disallowed malicious_ca.cer

Once placed in the Disallowed store, Windows will immediately block any connection, driver, or executable signed by that CA, even if reinstalled elsewhere on the system.

Auditing Certificate Stores via PowerShell

PowerShell provides an interactive virtual drive provider (Cert:\) that treats Windows certificate stores like standard filesystem directories, enabling rapid programmatic filtering.

1. Listing Non-Microsoft Root Certificates

To isolate third-party root certificates installed across your local machine that do not belong to Microsoft:

Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object { $_.Issuer -notmatch "Microsoft" } | Select-Object Subject, Thumbprint, NotAfter | Format-Table -AutoSize

This command strips the hundreds of default Microsoft roots and isolates third-party CAs, allowing security auditors to review external trust relationships within seconds.

2. Verifying Certificate Chain Validity

To test whether a specific suspicious certificate file chains back to an unrevoked, legitimate root authority:

certutil -verify -urlfetch "C:\Temp\SuspectCert.cer"

The -urlfetch switch forces certutil to query online Certificate Revocation Lists (CRLs) and Online Certificate Status Protocol (OCSP) responders to confirm revocation status.

Best Practices for Root Certificate Governance

Maintain operating system cryptographic hygiene by following these defensive operational standards:

• Group Policy Root Auto-Update: Ensure the Group Policy setting Turn off Automatic Root Certificates Update (under Computer Configuration > Administrative Templates > System > Internet Communication Management) is set to Disabled or Not Configured. This guarantees Windows receives regular cryptographic trust updates automatically from Microsoft.
• Purging User-Level Roots: Standard enterprise workstations should never contain root CAs in the Current User store (certmgr.msc). Any root certificate located under Cert:\CurrentUser\Root should be audited immediately, as non-admin installers frequently exploit user-level stores to inject proxy certificates without UAC elevation.