Try modify the Intended Purposes of the Common Policy root CA cert on all DCs and set the policy to disable the 3rd Party Trusted Root store. Any roots that need to be trusted by the organization will need to be published to Active Directory. Best Regards Dale Qiao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.com