The link in step 1 does not work. It comes back with a 404 File or directory not found error: “The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.” What is the correct links? Thanks.

As rootsupd.exe was deprecated in favor of WU auto update and Enterprise CA…
You could get the trusted and untrusted sst files and import those.
(there are different options)

…

Below I assume you have a C:\Temp (or make a location of your choice)

Open a command Prompt; Run as Administrator
untrusted:
Run: certutil -syncwithwu  c:\Temp
It should say something like: added xxx files, updated xxx files / certutil completed successfully
Check to see if disallowedcert.sst is created
trusted:
Run: certutil -generateSSTFromWU c:\Temp\authroot.sst
It should say something like: updates sst file / certutil completed successfully
(try again on memory error = uncommon)

make 2 powershell scripts:
1. discert.ps1
[reflection.assembly]::LoadWithPartialName(“System.Security”)
$certs = new-object system.security.cryptography.x509certificates.x509certificate2collection
$certs.import(“c:\temp\authroot.sst”)
$store = new-object system.security.cryptography.X509Certificates.X509Store -argumentlist “AuthRoot”, LocalMachine
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]”ReadWrite”)
$store.AddRange($certs)
2. authcert.ps1
[reflection.assembly]::LoadWithPartialName(“System.Security”)
$certs = new-object system.security.cryptography.x509certificates.x509certificate2collection
$certs.import(“c:\temp\disallowedcert.sst”)
$store = new-object system.security.cryptography.X509Certificates.X509Store -argumentlist “Disallowed”, LocalMachine
$store.Open([System.Security.Cryptography.X509Certificates.OpenFlags]”ReadWrite”)
$store.AddRange($certs)

place those 2 scripts in C:\Temp
Open a powershell command prompt as administrator (or start powershell in same prompt)
Run: .\discert.ps1
Run: .\authcert.ps1

Check:
Open MMC.exe
Click ctrl+M
Add the Certificates mmc and select Computer account
Check if the changes that Microsoft provided are added to the Untrusted Certificates folder, Third Party Root Certificates Authorities folder
List:
https://social.technet.microsoft.com/wiki/contents/articles/31680.microsoft-trusted-root-certificate-program-updates.aspx

Ref.
https://social.technet.microsoft.com/wiki/contents/articles/31634.microsoft-trusted-root-certificate-program-participants.aspx
https://social.technet.microsoft.com/wiki/contents/articles/33315.microsoft-trusted-root-certificate-program-portal.aspx
https://technet.microsoft.com/library/dn265983.aspx
https://blogs.technet.microsoft.com/vishalagarwal/2009/08/13/adding-certificates-for-a-serialized-store-sst-file-to-an-actual-physical-store/

1 user thanked author for this post.

owdrtn

Rydan wrote:

As rootsupd.exe was deprecated in favor of WU auto update and Enterprise CA…
You could get the trusted and untrusted sst files and import those.
(there are different options)

Awesome find @rydan.. works flawless, thanks !
Where have you found your way to the shell scripting of this ? I couldn’t find anything on that matter from the provided online docu.

Thumbs up !!

As this thread was started in July 2017, how relevant is it now?