Prevent and/or detect installation of root certificates on Windows?

Question

I noticed that some applications installed root certificates on my computer.

• Is it possible to prevent this?
• Or is there a firewall or such that notifies me?

Answer 1

Windows Environments.

Background

Windows servers that have internet connectivity reach out to CA servers and automatically update Trusted Root Authority certs, CTL, STL and Revoked certificates. This occurs in the background and requires zero input or interaction from the user.

Why control it?

Many government environments like to shut this setting off as it's all about control. For instance when the Dell's eDellRoot CA certificate was first shown to be a vulnerability - Microsoft didn't revoke it right away. It took a few days before it ended up on any Untrusted or Revoked list. So many in the security field feel as though they can react faster by controlling the lists themselves. Many reduce the threat as soon as they find out through various channels as opposed to waiting for Microsoft teams deeming something unsafe.

How to control it?

To turn off Automatic Root Certificates Update via Local Group Policy Editor:

• Click Start, and then click Run.

• Type gpedit.msc, and then click OK.

• If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
• Under computer configuration, Double-click Administrative Templates, double-click System, double-click Internet Communication Management, and then click Internet Communication settings.
• Double-click Turn off Automatic Root Certificates Update, click Enabled, and then click OK.
• Close the Local Group Policy Editor.

Note that doing it this way is safer than turning off Automatic Updates. Because you still want other security patches to be applied. (Assuming you have an internet connection.)

Answer 2

If you know the directory where root CAs are installed, then you could adjust the permissions for writing to that directory. If you set that directory to only be readable and not writeable, then you would prevent installation of new certificates.

Also, you could set up an alert system that would notify you when anything in that directory changes. This way, you could allow new CAs to be installed, and you would be able to check up on the changes to verify them.

This can all be done in Linux/Unix/BSD/Mac operating systems.