It looks like my server admin tools are adding the following unwanted settings to every GPO I touch.
Computer Configuration/Policies/Windows Settings/Security Settings/Local Policies/Security Options/Public Key Policies/Trusted Root Certification Authorities
Allow users to select new root certification authorities (CAs) to trust: Enabled
Client computers can trust the following certificate stores: Third-Party Root Certification Authorities and Enterprise Root Certification Authorities
To perform certificate-based authentication of users and computers, CAs must meet the following criteria: Registered in Active Directory only
It's causing weird problems like certain CAs stop being trusted by IE. What the heck is going on? I'm using the RSAT 2008 r2/Win 7 on a Win 7 x64 machine.