Manage Trusted Root Certificates
Applies To: Windows Server 2008
Because of the growing variety of certificates in use today and the growing number of certificate issues, some organizations may want to manage certificate trust and prevent users in the domain from configuring their own set of trusted root certificates. In addition, some organizations may want to identify and distribute specific trusted root certificates to enable business scenarios where additional trust relationships are needed.
Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.
To manage trusted root certificates for a local computer
Click Start, click Start Search, type mmc, and then press ENTER.
On the File menu, click Add/Remove Snap-in.
Under Available snap-ins, click Local Group Policy Object Editor,click Add, select the computer whose local Group Policy object (GPO) you want to edit, and then click Finish.
If you have no more snap-ins to add to the console, click OK.
In the console tree, go to Local Computer Policy, Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.
Double-click Certificate Path Validation Settings,and thenclick the Stores tab.
Select the Define these policy settings check box.
Under Per user certificate stores, clear the Allow user trusted root CAs to be used to validate certificates and Allow users to trust peer trust certificates check boxes.
Under Root certificate stores, select the root CAs that the client computers can trust, and then click OK to apply the new settings.
Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.
To manage trusted root certificates for a domain
Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.
After the Installation Results page shows that the installation of the Group Policy Management Console (GPMC) was successful, click Close.
Click Start, point to Administrative Tools, and then click Group Policy Management.
In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy GPO that you want to edit.
Right-click the Default Domain Policy GPO, and then click Edit.
In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.
Double-click Certificate Path Validation Settings, and then click the Stores tab.
Select the Define these policy settings check box.
Under Per user certificate stores, clear the Allow user trusted root CAs to be used to validate certificates and Allow users to trust peer trust certificates option in the Per User Certificate Stores check boxes.
Under Root certificate stores, select the root CAs that the client computers can trust, and then click OK to apply the new settings.
Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.
To add certificates to the Trusted Root Certification Authorities store for a local computer
Click Start, click Start Search, type mmc, and then press ENTER.
On the File menu, click Add/Remove Snap-in.
Under Available snap-ins, click Certificates,and then click Add.
Under This snap-in will always manage certificates for, click Computer account, and then click Next.
Click Local computer, and click Finish.
If you have no more snap-ins to add to the console, click OK.
In the console tree, double-click Certificates.
Right-click the Trusted Root Certification Authorities store.
Click Import to import the certificates and follow the steps in the Certificate Import Wizard.
Domain Administrators is the minimum group membership required to complete this procedure. Review the details in "Additional considerations" in this topic.
To add certificates to the Trusted Root Certification Authorities store for a domain
Open Server Manager, and under Features Summary, click Add Features. Select the Group Policy Management check box, click Next, and then click Install.
After the Installation Results page shows that the installation of the GPMC was successful, click Close.
Click Start, point to Administrative Tools, and then click Group Policy Management.
In the console tree, double-click Group Policy Objects in the forest and domain containing the Default Domain Policy GPO that you want to edit.
Right-click the Default Domain Policy GPO, and then click Edit.
In the GPMC, go to Computer Configuration, Windows Settings, Security Settings, and then click Public Key Policies.
Right-click the Trusted Root Certification Authorities store.
Click Import and follow the steps in the Certificate Import Wizard to import the certificates.
Additional considerations
- Group Policy options can only be changed by an administrator.