Where Windows Registry Stores Root Certificates

This article explains where the Windows Registry stores the list of Trusted Root Certification Authorities for both the machine and individual user profiles. It details the exact registry paths for system-wide certificates, enterprise policies, user-specific trust anchors, and automatically updated third-party root authorities.

System-Wide Trusted Root Store (Local Machine)

For machine-wide trust that applies to all services and users, the Windows Registry stores Trusted Root Certification Authorities under the following path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates

Within this key, each installed root certificate is represented by a subkey named after the certificate’s unique SHA-1 hash (thumbprint). Inside each thumbprint key, a binary registry value named Blob contains the raw certificate data, properties, and public key information.

Current User Trusted Root Store

If a certificate is imported exclusively for the logged-in user rather than the entire system, it is stored in the current user hive:

HKEY_CURRENT_USER\Software\Microsoft\SystemCertificates\Root\Certificates

Certificates stored here are only trusted by applications running under that specific user context.

Group Policy Trusted Root Store

When root certificates are distributed across an Active Directory domain or configured via local Group Policy, they are written to a dedicated policy key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\Certificates

Certificates deployed here take precedence and cannot be removed by standard users via the certificate management console (certmgr.msc).

Automatic and Third-Party Root Store

Windows manages public third-party root certificates dynamically via the Windows Update mechanism. These automatically synchronized certificates reside in:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates

Additionally, Active Directory enterprise-level certificates are located under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates