[tonyarkles]

Correct re: the root cert in my experience at least. They usually get pushed out as part of a Group Policy in Active Directory.