#Update 2016-01-06: It's NOT the sum of CertMgmt.msc and CertLM.msc after all. Not even when you're fully patched.

When giving this answer I wrote CERTLM [...] That's where the 300-something built-in roots should be visible.

Turns out that this was plain wrong. Sorry.

I had sort of assumed that the "go online" part of the Windows root certificate mechanism would only really kick in, if hadn't done your regular updates in a long, long while.

Well, no.

It's that way on my fully patched Win10 machine. Only 82 certs locally. But 340-something online. Huh.

Old and wrong original post preserved below.

You're missing CERTLM

Windows uses the sum of the roots from

• CERMGR, the current user's certificates and
• CERTLM, the Local Machine's certificates. That's where the 300-something built-in roots should be visible.

Update 1

1. Why doesn't Windows display all 343 root CA certificates if they are potentially willing to use them (depending on my web browsing needs) at a future date?

I can only guess at that. Weird design decision I guess.

2. Are there any potential security problems from the fact that Windows does not display all trusted root CA certificates through certmgr.exe?

Yes. It's needlessly complicated, that's never good for security.

Update 2016-01-06: It's NOT the sum of CertMgmt.msc and CertLM.msc after all. Not even when you're fully patched.

When giving this answer I wrote CERTLM [...] That's where the 300-something built-in roots should be visible.

Turns out that this was plain wrong. Sorry.

I had sort of assumed that the "go online" part of the Windows root certificate mechanism would only really kick in, if hadn't done your regular updates in a long, long while.

Well, no.

It's that way on my fully patched Win10 machine. Only 82 certs locally. But 340-something online. Huh.

Old and wrong original post preserved below.

You're missing CERTLM

Windows uses the sum of the roots from

• CERMGR, the current user's certificates and
• CERTLM, the Local Machine's certificates. That's where the 300-something built-in roots should be visible.

Update 1

1. Why doesn't Windows display all 343 root CA certificates if they are potentially willing to use them (depending on my web browsing needs) at a future date?

I can only guess at that. Weird design decision I guess.

2. Are there any potential security problems from the fact that Windows does not display all trusted root CA certificates through certmgr.exe?

Yes. It's needlessly complicated, that's never good for security.

You're missing CERTLM

Windows uses the sum of the roots from

• CERMGR, the current user's certificates and
• CERTLM, the Local Machine's certificates. That's where the 300-something built-in roots should be visible.

Update 1

1. Why doesn't Windows display all 343 root CA certificates if they are potentially willing to use them (depending on my web browsing needs) at a future date?

I can only guess at that. Weird design decision I guess.

2. Are there any potential security problems from the fact that Windows does not display all trusted root CA certificates through certmgr.exe?

Yes. It's needlessly complicated, that's never good for security.

#Update 2016-01-06: It's NOT the sum of CertMgmt.msc and CertLM.msc after all. Not even when you're fully patched.

When giving this answer I wrote CERTLM [...] That's where the 300-something built-in roots should be visible.

Turns out that this was plain wrong. Sorry.

I had sort of assumed that the "go online" part of the Windows root certificate mechanism would only really kick in, if hadn't done your regular updates in a long, long while.

Well, no.

It's that way on my fully patched Win10 machine. Only 82 certs locally. But 340-something online. Huh.

Old and wrong original post preserved below.

You're missing CERTLM

Windows uses the sum of the roots from

• CERMGR, the current user's certificates and
• CERTLM, the Local Machine's certificates. That's where the 300-something built-in roots should be visible.

Update 1

1. Why doesn't Windows display all 343 root CA certificates if they are potentially willing to use them (depending on my web browsing needs) at a future date?

I can only guess at that. Weird design decision I guess.

2. Are there any potential security problems from the fact that Windows does not display all trusted root CA certificates through certmgr.exe?

Yes. It's needlessly complicated, that's never good for security.

You're missing CERTLM

Windows uses the sum of the roots from

• CERMGR, the current user's certificates and
• CERTLM, the Local Machine's certificates. That's where the 300-something built-in roots should be visible.

You're missing CERTLM

Windows uses the sum of the roots from

• CERMGR, the current user's certificates and
• CERTLM, the Local Machine's certificates. That's where the 300-something built-in roots should be visible.

Update 1

1. Why doesn't Windows display all 343 root CA certificates if they are potentially willing to use them (depending on my web browsing needs) at a future date?

I can only guess at that. Weird design decision I guess.

2. Are there any potential security problems from the fact that Windows does not display all trusted root CA certificates through certmgr.exe?

Yes. It's needlessly complicated, that's never good for security.