Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. catroot2
FolderRisk: Caution

catroot2 C:\Windows\System32\catroot2

Signature catalog database used by Cryptographic Services; resettable as a last resort for Windows Update.

Updated on By AltF4 Formation

What it’s for

catroot2 is the signature catalog database of Cryptographic Services (CryptSvc). It is used to verify update and driver packages, while the .cat files themselves sit in the neighboring catroot folder. Microsoft mentions renaming it in its Windows Update reset procedures.

What it contains

  • A catalog database that CryptSvc recreates as needed.
  • GUID-named subfolders, including {F750E6C3-38EE-11D1-85E5-00C04FC295EE}, which holds the database files.

Risks and best practices

  • Do not empty it as a reflex. Renaming catroot2 to catroot2.bak is a last resort, when the earlier Windows Update reset steps have failed, or for certain metadata errors such as 0x80242006.
  • Do it in order: stop cryptsvc, rename the folder (do not delete it), restart the service. Windows recreates an empty folder. Keep the old one until you have validated the result.
  • An “Access denied” error on the rename usually means the service is still running.

Useful commands

Fenêtre de terminal
# Cryptographic Services state
Get-Service CryptSvc


# Database subfolders
Get-ChildItem "$env:windir\System32\catroot2" -Force
Fenêtre de terminal
:: Last-resort reset (as administrator)
net stop cryptsvc
ren %systemroot%\System32\catroot2 catroot2.bak
net start cryptsvc

Report a mistake