On this Microsoft page, they mention that a new feature in Windows 10 is that it can stop trusting root certificates using the Disabled and NotBefore properties. What is the exact meaning of these properties, and how does disabling a root differ from removing it?
I could not find a Microsoft page explaining (or even mentioning) these new features in any detail.
For instance: what exactly does Windows 10 do if a root gets automatically "disabled" via an update? Does it move the certificate to "Untrusted Certificates" container?