Windows Server provides a certificate authority service. However, it's not clear from its documentation how (or if) the root certificate gets distributed to clients.
- Do domain member computers automatically trust the root certificate?
- If so, how and when do they get the certificate?
- Is there any user interaction required for the root certificate to be installed or trusted?
- Does the client poll Active Directory? Is it in AD DNS?
- Will it only get it during login?
- What if a domain member remotely VPNs into the LAN?
- Are there any caveats for different versions of Windows clients?