How to Clear the Windows Cryptographic Services (CatRoot2) Cache via PowerShell

The Cryptographic Verification Bottleneck

When a Windows Server or a Windows 10/11 workstation downloads a massive cumulative update or attempts to install a new hardware driver, the operating system does not blindly trust the file. It leverages the Cryptographic Services (CryptSvc) to cryptographically verify the digital signature embedded within the binary against Microsoft’s trusted root certificates.

To speed up this verification process for millions of files, Windows caches these cryptographic signatures and catalog files in a specialized directory called CatRoot2. Unfortunately, this database is highly susceptible to corruption, especially during unexpected power failures or interrupted Windows Updates.

When CatRoot2 becomes corrupted, the symptoms are catastrophic for system maintenance: Windows Update will get permanently stuck at 0% downloading, SCCM software deployments will fail with obscure hash mismatch errors, and attempting to install a standard printer driver will result in a vague “Access Denied” or “Invalid Signature” prompt.

To restore the cryptographic integrity of the system, you must forcefully wipe the CatRoot2 cache using PowerShell.

Locating the CatRoot2 Directory

The cryptographic cache is located deep within the Windows System32 hierarchy.

There are actually two folders: CatRoot and CatRoot2.

• C:\Windows\System32\CatRoot: Contains the actual, permanent security catalogs. Do not ever delete or rename this folder. Doing so will irreparably destroy the operating system’s ability to boot.
• C:\Windows\System32\CatRoot2: This is purely a temporary working cache used during the verification process. This is the folder we must target.

Clearing the Cache using PowerShell

Because the Cryptographic Service constantly holds a hard lock on the CatRoot2 folder, you cannot delete it via File Explorer. You must stop the service, purge the directory, and restart the engine using an elevated PowerShell session.

Open PowerShell as Administrator and execute the following script carefully:

# 1. Stop the Cryptographic Services
Stop-Service -Name CryptSvc -Force

# 2. Stop the Windows Update Service (which relies on CryptSvc)
Stop-Service -Name wuauserv -Force

# 3. Rename the corrupted cache folder
# Renaming is vastly safer and faster than recursively deleting thousands of files
Rename-Item -Path "C:\Windows\System32\catroot2" -NewName "catroot2.CORRUPT" -Force

# 4. Restart the Cryptographic Services
Start-Service -Name CryptSvc

# 5. Restart Windows Update
Start-Service -Name wuauserv

The Rebuilding Process

The moment you execute Start-Service -Name CryptSvc, the Windows kernel will look for the CatRoot2 folder, realize it is missing, and instantly generate a brand-new, completely clean directory.

The system will then begin a silent background process of pulling the permanent catalog files from the CatRoot folder, calculating their hashes, and repopulating the new CatRoot2 cache database. This process consumes a small amount of CPU for about 5 minutes.

Cleanup

Once you have verified that Windows Update is functioning correctly and successfully downloading patches, you can safely delete the backup folder to reclaim disk space.

Remove-Item -Path "C:\Windows\System32\catroot2.CORRUPT" -Recurse -Force

The server’s cryptographic verification pipeline is now completely restored and fully operational.