Windows 10: Group Policy Lockdown: Install Root Certificate

Hello,I am looking to implement a mitigation recommendation from MITRE outlined on the following page:https://attack.mitre.org/techniques/T1553/004/The recommendation is to prevent users from installing their own root certificate with non-admin privileges through a change in group policy. The change outlined is as follows:Windows Group Policy can be used to manage root certificates and theFlagsvalue ofHKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRootscan be set to 1 to prevent non-administrator users from making further root installations into their own HKCU certificat

:)

 

Win store do not allow to import root certificate

Dear All,

could you please tell me, when and what
was change in Windows policy for importing root certificates in Windows store.

This is quite new, let's say is it appearing approximately 2 months.

What in group policy need to be change, that usual user could import root certificate in Win store?

( Mozilla Store it imported without the problem, If we run IE as admin, we can imported root certificate manually)

We would like to have simply advise how our customer could import root certificate
automatically and not manually as admin?

 

GROUP POLICIES IN WINDOWS 10

You can change Group Policies by opening Group Policy Editor first. You can open it by following these steps:

• Log in an administrator account. If you are already logged in as an administrator, proceed to step 2.
  
• Press Windows + R to open Run.
• Type gpedit.msc and press Enter.
  

After opening Group Policy Editor, you can now make the necessary changes that you want.

Should you have more concerns, feel free to post.

Regards.

 

GROUP POLICIES IN WINDOWS 10

Just what i needed thank you.