How to set script to enable CAPI2 for investigate internal certificates are disappeared

Question

Since 10 Jun 2025, we are received some users reported that cannot access the internal system. After investigated, some internal certificates are disappeared in “certmgr.msc”. The affected users are accumulated over 250 users of total 14,000 uses even Windows 10 & 11.

As we are no idea of the root cause, we plan to enable to the “CAPI2” of event log for further investigation.

 

We planned to deploy the registry script or PowerShell script to enable the event log thought client management tools.

 

May I know how to configuration the script?

And the Maximum log size and overwrite events as needed.

If available, save the log file as specific folder.

 

As the object to find the root cause, please let me know if any idea of this issue. Thanks.

Answer 1

Hello,

Thank you for posting question on Microsoft Windows Forum!

Based on your query of configuring script to enable CAPI2 for investigating missing internal certificates. You can enable CAPI2 log using traditional method like following steps.

1. Open Event Viewer (press Win + R, type eventvwr, and press Enter).
2. Navigate to Applications and Services Logs -> Microsoft -> Windows -> CAPI2 -> Operational
3. Now right-click and Clear Log to delete all existing logs (if any).
4. To enable the logs right-click again and select Enable Log.
5. Reproduce the issue.
6. To disable the CAPI2 logs right- click and select Disable Log.

Regarding the script for enabling the log. You can refer to the following article for further reference.

• https://github.com/jajp777/powershell-scripts-1/blob/master/Enable-Capi2Logging.ps1

The followings are some possible causes for disappearing certificates:

1.Group Policy Object (GPO) Misconfiguration/Corruption:

• Certificate Auto-Enrollment: If certificates are deployed via GPO for auto-enrollment, a misconfigured GPO could be causing them to be removed or not renewed. Check the "Public Key Policies" within your GPOs.
• Restricted Certificates/Untrusted Publishers: A GPO might be configured to explicitly disallow or remove certain certificates, or to mark your internal CA as untrusted.
• GPO Processing Issues: Are GPOs applying correctly to the affected machines? Use gpresult /h result.html on an affected machine to check which GPOs are applied and if there are any errors.
• Conflicting GPOs: Could there be conflicting GPOs that are applying different certificate policies?

2.Third-Party Software/Agents:

• Are there any other security agents, VPN clients, or system management tools that interact with certificate stores? A bug or misconfiguration in such software could lead to certificate removal.

3.Expired Certificates and Renewal Issues:

• While you mentioned "disappeared," it's worth checking if the certificates simply expired and the renewal process failed. CAPI2 logs will be key here. Look for events related to certificate expiration, revocation, or chain building failures.

4.Store Corruption:

• Run for affected users: certutil -user -verify (user store) certutil -verify (system store)
• Check for event ID 41 in Application logs (CryptoAPI errors)

5.Critical Events to Monitor in CAPI2 Log:

• Event ID 11 (Build Chain): Indicates errors during certificate chain building. Look for ErrorStatus and RevocationStatus in the details. Common errors include CERT_TRUST_IS_OFFLINE_REVOCATION (cannot check revocation status) or CERT_TRUST_STATUS_INVALID_TIME (time issues).
• Event ID 30 (Verify Chain): Similar to Event 11, indicates issues during certificate chain verification.
• Event ID 40, 41 (Store Operations): Can show operations like adding, deleting, or opening certificate stores. Look for unexpected delete operations.
• Event ID 53 (Object Open/Close): Related to cryptographic object handling.
• Event ID 64 (Cryptographic Operation Failed): A generic error, but details can point to certificate issues.

Extra article for more information about log enabling.

• https://techcommunity.microsoft.com/blog/iis-support-blog/how-to-configure-and-collect-schannel-and-capi2-logs/4251751

Hope the above information is helpful!