Network Management

Set Group Policy "Turn off Automatic Root Certificate Update" on SolarWinds Platform server (in Offline environments only)

This article describes how to disable root certificate checks if you experience slow page loads in the SolarWinds Platform Web Console, as related to the Automatic Root Certificates Update component in Windows. In WPM, delays can block transaction playback by interrupting WPM Worker processes. This setting is enabled by default. This article discusses when and how to configure the Windows Group Policy setting Turn off Automatic Root Certificate Update on a SolarWinds Platform server that operates in an offline or no-internet environment. This workaround should be considered only when certificate validation checks are contributing to slow Web Console page loads, delays in web-based connections, or WPM transaction playback delays.

First published date

10/23/2018 8:52 AM

Last published date

12/3/2025 1:22 AM

Overview

Windows uses Automatic Root Certificate Update to download and install new trusted root certificates as needed. This ensures secure connections, code-signing validation, and encrypted communication work correctly across the system.

If SolarWinds Platform Web Console pages load slowly when you access a device, or you experience delays when connecting through the web pages on the SolarWinds server, you can disable root certificate checks that may be slowing communication. This guidance applies only if your SolarWinds Platform server operates in an offline or no-internet environment. In these scenarios, Windows cannot retrieve new root certificates automatically, and you may choose to use the Windows Group Policy Turn off Automatic Root Certificates Update.

However:

  • Setting the Group Policy Turn off Automatic Root Certificates Update to Enabled may cause failures in any feature that relies on SSL certificate validation.
  • If the Group Policy is set to Enabled, administrators are fully responsible for manually importing and maintaining all required root and intermediate certificates.

 

Warning

SolarWinds strongly recommends keeping Automatic Root Certificate Update Group Policy Enabled.

Disabling this feature can lead to:

  • SSL certificate validation failures

  • Errors when establishing secure HTTPS connections

  • Product installation or upgrade failures

  • Service disruptions caused by missing or outdated root certificates

  • Inability to validate code-signed components

If this feature is ENABLED, Windows cannot automatically trust newer or replacement Certificate Authorities.

 



 

Product section

Orion Platform

Cause

Communication delays related to the Automatic Root Certificates Update component can cause the issues described above.

This component checks the list of trusted authorities on the Microsoft Windows Update website.

 

A list of trusted root certification authorities (CAs) is stored on the local computer.

When an application is presented with a certificate issued by a CA, it checks the local copy of the trusted root CA list.

 

If the certificate is not in the list, the Automatic Root Certificates Update component contacts the Microsoft Windows Update website to see whether an update is available.

If the CA has been added to the Microsoft list of trusted CAs, its certificate is automatically added to the trusted certificate store on the computer.

 

Resolution

 

Note:

Before proceeding, note the following:

  • This configuration change can impact the security of your deployment. Before proceeding, your organization should internally review and assess the impact of disabling certificate updates.
  • You must be a member of the local Administrators group, or have been delegated the appropriate authority.
  • This process uses the Windows Group Policy setting Turn off Automatic Root Certificates Update. Setting this policy to Enabled disables the automatic root certificate updates.
  • Perform these steps on the SolarWinds server.

 

To disable automatic updates to root certificates in Windows Server 2012: 

  1. Log into the SolarWinds server.
  2. Click Start, and then click Run.
  3. Type gpedit.msc, and click OK.
    If the User Account Control (UAC) dialog box opens, confirm that it displays the correct action and click Continue.
  4. When the Local Group Policy Editor opens, expand Computer Configuration > Administrative Templates > System > Internet Communication Management, and then click Internet Communication Settings.
  5. On the Internet Communication Settings page, double-click Turn off Automatic Root Certificates Update.
  6. Click Enabled, and then click OK.
  7. Close the Local Group Policy Editor dialog box. 

For later Windows Server versions, see How to enable the "automatic root certificates update" on Windows Server 2016.