Military CAC Certs Keep Getting Wiped

Question

I just bought a new HP Omen 17 with Windows 11. Owned for a month and every time it updates it wipes my CAC trusted certs from the directory.

I’ve been reinstalling the certs with CertUtil each time but it’s happening on a weekly basis. Is there any way to permanently prevent this from happening?

Answer 1

Hello

1. Check Group Policy Settings (Windows Update Behavior)

Windows Update may be inadvertently removing certificates due to certain group policy settings. You can configure Group Policy to prevent this behavior.

Steps to check Group Policy settings:

Press Windows + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor.

Navigate to:
Computer Configuration -> Administrative Templates -> System -> User Profiles

Look for the policy setting called "Do not delete user profiles on system shutdown". Ensure this is set to Enabled. This will prevent Windows from deleting user profile data, including certificates, during updates or restarts.

Also, check under:
Computer Configuration -> Administrative Templates -> Windows Components -> Windows Update
Look for any policies related to updates affecting certificate management, and make sure there aren’t any aggressive cleaning policies in place.

2. Ensure the Certificates are Installed in the Correct Store

Certificates for the Common Access Card (CAC) should be installed in the Windows Certificate Store, specifically in the Personal store.

To ensure that certificates are in the right place:

Open Microsoft Management Console (MMC) by pressing Windows + R, typing mmc, and hitting Enter.

In MMC, click File -> Add/Remove Snap-in.

Select Certificates and click Add.

Choose Computer account and then Local computer.

Expand Certificates, and navigate to Personal.

Ensure your CAC certificates are listed here.

If they are being installed into Current User instead of Local Machine, it might be causing them to be wiped upon system updates. Make sure they’re installed in the Local Machine store for persistence.

3. Prevent Certificate Removal by Windows Update

Sometimes, Windows may overwrite certain system configurations or certificates during updates. You can try the following workaround:

Registry Edit to Prevent Auto-Removal:

Open Registry Editor (regedit).

Navigate to:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Wintrust\Config

Look for any entries that might be forcing Windows to remove or reset certificates and remove or change those values as needed.

Also, check:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Look for any entries like "DisableCertificateRevocationCheck" or similar, which may be causing Windows to reset the certificate store during updates.

4. Update or Install the Latest Drivers for Your CAC Reader

Since you’re using a CAC card, it's essential that your CAC reader is up-to-date and fully compatible with Windows 11. A driver issue may lead to certificates not being correctly stored after updates. Here’s how you can ensure compatibility:

Visit the HP support website for your HP Omen 17 and make sure your system is running the latest updates, including firmware, chipset, and CAC reader drivers.

Install the latest smart card drivers. If the drivers provided by HP are outdated, consider downloading and installing the latest ones from the smart card manufacturer (e.g., Gemalto, Identiv, ActivClient).

5. Ensure Windows is Configured to Retain Certificates Across Updates

You can also configure Windows 11 to ensure certificates are retained even after updates:

Press Windows + I to open Settings.

Go to Privacy & Security → Windows Security → Device Security.

Under Security processor details, check if the TPM (Trusted Platform Module) and secure boot are enabled. This can sometimes affect how certificates are handled and retained.

I hope the above information is helpful to you.

Best regards

Runjie Zhai