We're concerned about imposter Web sites that try to
fool users by using rogue certification authorities (CAs). Windows automatically
trusts enough third-party CAs as it is. How can we prevent users from trusting
CAs they encounter while browsing the Web?
Use the Microsoft Management Console (MMC) Group Policy Editor snap-in to open
a Group Policy Object (GPO) linked to an organizational unit (OU) containing
your user workstations. Navigate to Computer Configuration, Windows Settings,
Security Settings, Trusted Root Certification Authorities. Right-click Trusted
Root Certification Authorities and select Properties. Clear the Allow users
to select new root certification authorities (CAs) to trust check box. Click
OK. After a workstation refreshes Group Policy, it will no longer allow a user
to add a CA's certificate to the Trusted Root Certification Authorities store.
Users will still be able to access Web sites that present certificates signed
by untrusted CAs, but users will always be warned that the Web site's certificate
isn't trusted. (Note that this method works only on Windows XP systems and requires
a Windows Server 2003 domain controller—DC).
Register
