When the certificate snap-in is used to delete the user certificate in user personal store, only the certificate is deleted, the private key is left on the machine. If later the same certificate is imported to user personal store, it’s by design that CAPI2 *may* be able to find the private key even though there was no explicit key association attached to the cert after it was re-imported.
Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.