Turn off Automatic Root Certificates Update
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
Path in the GPO console
Computer Configuration\Administrative Templates\System\Internet Communication Management\Internet Communication settings Description
This policy setting specifies whether to automatically update root certificates using the Windows Update website. Typically, a certificate is used when you use a secure website or when you send and receive secure email. Anyone can issue certificates, but to have transactions that are as secure as possible, certificates must be issued by a trusted certificate authority (CA). Microsoft has included a list in Windows XP and other products of companies and organizations that it considers trusted authorities. If you enable this policy setting, when you are presented with a certificate issued by an untrusted root authority, your computer will not contact the Windows Update website to see if Microsoft has added the CA to its list of trusted authorities. If you disable or do not configure this policy setting, your computer will contact the Windows Update website.
Registry
Software\Policies\Microsoft\SystemCertificates\AuthRoot Value name: DisableRootAutoUpdate
Enabled: DisableRootAutoUpdate = 1
Disabled: DisableRootAutoUpdate = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_ICM/CertMgr_DisableAutoRootUpdates Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Turn off Automatic Root Certificates Update
; State: Enabled
; Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot]
"DisableRootAutoUpdate"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Turn off Automatic Root Certificates Update
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_ICM/CertMgr_DisableAutoRootUpdates
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Turn off Automatic Root Certificates Update
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SystemCertificates\AuthRoot' -Name 'DisableRootAutoUpdate' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn off Automatic Root Certificates Update
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Turn off Automatic Root Certificates Update
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Turn off Automatic Root Certificates Update
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\SystemCertificates\AuthRoot' -Name 'DisableRootAutoUpdate' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Turn off Automatic Root Certificates Update
# State: Enabled
# Supported on: At least Windows Server 2003 operating systems with SP1 or Windows XP Professional with SP2
$path = 'HKLM:\Software\Policies\Microsoft\SystemCertificates\AuthRoot'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisableRootAutoUpdate' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.