How to Delete a Certificate From a Windows Certificate Store Using PowerShell

To delete a certificate from a Windows certificate store with PowerShell, identify the right store and certificate, then remove its certificate-provider path with Remove-Item. Decide separately whether to include -DeleteKey: without that switch, the command removes the certificate entry without requesting deletion of its private key.

Find the certificate in the Windows certificate store

PowerShell exposes Windows certificate stores through the Cert: provider drive. The two common store locations are Cert:\CurrentUser, for the signed-in account, and Cert:\LocalMachine, for the computer. A store such as My contains personal certificates. Choose the location and store that contain the certificate you intend to remove.

List available stores with Get-ChildItem -Path Cert:\, then inspect the selected store with Get-ChildItem -Path Cert:\LocalMachine\My | Select-Object Subject, Thumbprint. The second command targets the local machine’s My store.

Find the intended entry by checking its subject and thumbprint. A subject can help distinguish certificates, but use the thumbprint to form the item path. Set the store and thumbprint variables from the entry you selected; replace the placeholder with the thumbprint shown on your system:

$storePath = 'Cert:\LocalMachine\My'; $thumbprint = '<thumbprint-from-your-store>'; $certificatePath = Join-Path -Path $storePath -ChildPath $thumbprint

Change Cert:\LocalMachine\My if the certificate is in a different store. These Windows certificate-provider commands are syntax examples and are unexecuted in a non-Windows PowerShell runtime.

Remove a certificate with PowerShell

After confirming the store path and thumbprint, remove that specific certificate-provider item with Remove-Item -Path "Cert:\LocalMachine\My\<thumbprint-from-your-store>", replacing the placeholder with the thumbprint you identified. Check both values before running the command: the store path determines where PowerShell looks, and the thumbprint selects the item. This Windows-specific syntax example is unexecuted and does not report a completed removal.

Choose whether to delete the private key

By default, removing a certificate from the store does not request deletion of its associated private key. Add -DeleteKey to the Remove-Item command only when you intend to remove the private key along with the certificate and the provider supports that operation. For example, use Remove-Item -Path $certificatePath -DeleteKey after defining $certificatePath from the selected store and thumbprint above.

The choice concerns private-key material as well as the visible certificate entry. Removing the certificate without -DeleteKey leaves the key outside this removal request; it does not prove that the key is present, accessible, or usable. Choose the option that matches your key-management needs before removing the certificate.

Verify the certificate and private key state

Query the same store path after removal and look for the selected thumbprint with Get-ChildItem -Path $storePath | Where-Object Thumbprint -EQ $thumbprint | Select-Object Subject, Thumbprint. These variables were set from the selected store and certificate above. If the thumbprint is absent from the query, the certificate is no longer listed in that store. If it remains, the removal is not confirmed; recheck the path and thumbprint before drawing a conclusion. This Windows-specific check is shown as syntax and is unexecuted here.

The check reports whether the selected certificate appears in the queried store. It does not establish whether private-key material remains or whether it can be used. A separate key check must match the key provider and storage location for your environment. For provider details, see Microsoft’s about_Certificate_Provider documentation.