Remove a certificate from the Windows "Network Service" certificate store

Solution 1:

Registry editor.

HKEY_USERS\S-1-5-20\Software\Microsoft\SystemCertificates\My

S-1-5-20 is the Network Service account. "My" represents the Personal store.

Delete the entries from there.

Source: http://support.microsoft.com/kb/185059

Solution 2:

You don't have to mess with Registry, see: How do you install a certificate in a PFX file in to the personal container of the NT-AUTHORITY\NetworkService? It is talking about installation, but nothing prevents you from deleting a certificate.

Solution 3:

Using psexec utility from Microsoft / sysinternals did the trick for me.

1. Download psexec. https://docs.microsoft.com/en-us/sysinternals/downloads/pstools

2. Open up a new console using psexec that will run as NETWORK SERVICE:

   .\PsExec64.exe -i -u "nt authority\network service" powershell

3. Run mmc

4. Add snapin for Certificate and use certificates from "My User Account"

5. Do whatever you want with the personal certificates for this account

All personal certificates should be visible for NETWORK SERVICE now.

This was at least needed for me to run the tool mage.exe that had a hard time doing code signing under the NETWORK SERVICE account since it only uses personal certificates.