# Script to delete certificate on Windows devices

Keeping devices secure often requires a robust certificate management system in place. Proper certificate management practices will also ensure that only valid and up-to-date certificates are used. However, if there is a lack of a dedicated tool for certificate management, IT administrators will have to manage certificate life cycles manually. Here’s a script that will help admins delete expired certificates to maintain seamless operation and security of the systems. Hexnode’s [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/) remote action for Windows simplifies script execution. It is a one-step action that allows admins to deploy customized scripts to devices.

 Note: 
**Supported Versions**:

The scripts given below will be supported on the following versions:

- Windows 10 v1607+ (Pro, Enterprise, Education)
- Windows 11 (Pro, Enterprise, Education)

[ ](https://developer.android.com/develop/connectivity/uwb#uwb-enabled_mobile_devices)

 

 Disclaimer: 
The sample scripts provided below are adapted from third-party open-source sites.

 

Batch Script
------------

To delete a certificate from LocalMachine, use the following script:

Sample Batch script to delete certificate from LocalMachine

certutil –delstore certificatestorename Thumbprint 

   1

  certutil –delstore certificatestorename Thumbprint 

   

 

  

Whereas, if you want to delete a certificate from current user, you can use the following script:

Sample Batch script to delete certificate from CurrentUser

certutil –delstore –user certificatestorename Thumbprint 

   1

  certutil –delstore –user certificatestorename Thumbprint 

   

 

  

**certutil** is a command-line tool on Windows that serves multiple functions related to certificates. It allows users to perform different operations on certificates. The **certutil** command with the **delstore** is used to delete certificates from a certificate repository on a device.
Replace “**Thumbprint**” with the actual thumbprint of the certificate you want to remove.

E.g: To delete a certificate with the thumbprint “8aa3c3a0a0152387f64b8392a72bd098a3a61c90” from Trusted Root Certification Authorities folder in current user.

`<br></br>certutil –delstore –user Root 8aa3c3a0a0152387f64b8392a72bd098a3a61c90<br></br>`

PowerShell Script
-----------------

Sample PowerShell script to delete certificate on Windows

Get-ChildItem Cert:\\LocalMachine\\certificatestorename\\Thumbprint | Remove-Item 

   1

  Get-ChildItem Cert:\\LocalMachine\\certificatestorename\\Thumbprint | Remove-Item 

   

 

  

The **Get-ChildItem** cmdlet is used to get items within a container, such as files in a directory. Here, **Get-ChildItem Cert** is used to retrieve details about certificates stored in the certificate repository on the device. The argument **Cert** refers to the certificate repository present on the device. The Remove-Item cmdlet is used to remove the specified certificate from the device.

If you want to delete a certificate from the current user, replace `LocalMachine` with `CurrentUser`.

E.g: To delete a certificate with the thumbprint “8aa3c3a0a0152387f64b8392a72bd098a3a61c90” from personal folder in local machine.

`<br></br>Get-ChildItem Cert:\LocalMachine\My\8aa3c3a0a0152387f64b8392a72bd098a3a61c90 | Remove-Item<br></br>`

 Notes:- Depending on the system store you need to delete the certificate from, replace ‘`certificatestorename`’ with `My`, `Root`, `CA`, or `Trust`.
- It is recommended to manually validate the script execution on a system before executing the action in bulk.
- Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.