Block certificate install request without blocking the existing connection

Question

Block certificate install request without blocking the existing connection

Gina Lambert 20

I have a user who uses a Gemalto Card Reader they plug in daily, each time they plug it in they receive a pop up request to install a root certificate. Every time they do click 'no' and they are able to use the externally connected device without issue, so the cert isn't needed for the use of it.

We have rebuilt the device twice to see if this resolves the issue, as they're the only user reporting this issue, so we initially suspected additional software being installed but that isn't the case.

Is there a way to block these pop ups without blocking the connection of the card reader?

Locked Question. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

Rukshan edirisinghe 2,365 Reputation points

2026-11-01T05:48:49.6366667+00:00
Hi @Gina Lambert

That prompt almost certainly comes from the smart card itself, not from the reader. When a card is inserted, Windows' certificate propagation reads the certificates on the card. If the card also carries a root CA certificate, Windows offers to add it to the trusted root store. That's the pop-up. It would also explain why only this one user sees it, even after two rebuilds: it's their card.

Windows has a policy for exactly this, and it's separate from normal card use:

Open Group Policy (or an Intune Settings catalog profile) for that device.

Go to Computer Configuration > Administrative Templates > Windows Components > Smart Card.

Set Turn on root certificate propagation from smart card to Disabled.

Leave Turn on certificate propagation from smart card as it is (enabled or not configured). That one copies the user's own certificates to their Personal store, which apps like Outlook may need.

Run gpupdate /force (or sync Intune), then remove and reinsert the card to test.

With only root propagation off, the card and its user certificates keep working. Windows just stops offering to install the card's root certificate. Since the user already clicks No with no ill effects, you lose nothing.

Before you roll it out more widely, check whether any of your apps rely on that root being trusted. If one does, deploy the root through Intune or GPO as a trusted certificate instead.

Is this a physical PC, or the user's Windows 365 Cloud PC with the reader redirected?

If the pop-up stops, please consider accepting it as the answer. If it still appears after the policy applies, let me know and I'll be happy to keep helping.

Reference:

https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings
JuliaMarvin 23,680 Reputation points Volunteer Moderator

2026-11-01T06:11:06.7433333+00:00

@Rukshan edirisinghe
Please refrain from resurrecting old threads.
See: [Article] Community Tip: Get the most out of active questions

Answer accepted by question author

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more

1 additional answer

Rukshan edirisinghe 2,365 Reputation points

2026-11-01T05:48:49.6366667+00:00

Hi @Gina Lambert

That prompt almost certainly comes from the smart card itself, not from the reader. When a card is inserted, Windows' certificate propagation reads the certificates on the card. If the card also carries a root CA certificate, Windows offers to add it to the trusted root store. That's the pop-up. It would also explain why only this one user sees it, even after two rebuilds: it's their card.

Windows has a policy for exactly this, and it's separate from normal card use:

Open Group Policy (or an Intune Settings catalog profile) for that device.

Go to Computer Configuration > Administrative Templates > Windows Components > Smart Card.

Set Turn on root certificate propagation from smart card to Disabled.

Leave Turn on certificate propagation from smart card as it is (enabled or not configured). That one copies the user's own certificates to their Personal store, which apps like Outlook may need.

Run gpupdate /force (or sync Intune), then remove and reinsert the card to test.

With only root propagation off, the card and its user certificates keep working. Windows just stops offering to install the card's root certificate. Since the user already clicks No with no ill effects, you lose nothing.

Before you roll it out more widely, check whether any of your apps rely on that root being trusted. If one does, deploy the root through Intune or GPO as a trusted certificate instead.

Is this a physical PC, or the user's Windows 365 Cloud PC with the reader redirected?

If the pop-up stops, please consider accepting it as the answer. If it still appears after the policy applies, let me know and I'll be happy to keep helping.

Reference:

https://learn.microsoft.com/en-us/windows/security/identity-protection/smart-cards/smart-card-group-policy-and-registry-settings
JuliaMarvin 23,680 Reputation points Volunteer Moderator

2026-11-01T06:11:06.7433333+00:00

@Rukshan edirisinghe
Please refrain from resurrecting old threads.
See: [Article] Community Tip: Get the most out of active questions

Answer 1

Deleted

This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

Comments have been turned off. Learn more