Preventing Users from Trusting CAs They Encounter While Browsing

We're concerned about imposter Web sites that try to fool users by using rogue certification authorities (CAs). Windows automatically trusts enough third-party CAs as it is. How can we prevent users from trusting CAs they encounter while browsing the Web?

Use the Microsoft Management Console (MMC) Group Policy Editor snap-in to open a Group Policy Object (GPO) linked to an organizational unit (OU) containing your user workstations. Navigate to Computer Configuration, Windows Settings, Security Settings, Trusted Root Certification Authorities. Right-click Trusted Root Certification Authorities and select Properties. Clear the Allow users to select new root certification authorities (CAs) to trust check box. Click OK. After a workstation refreshes Group Policy, it will no longer allow a user to add a CA's certificate to the Trusted Root Certification Authorities store. Users will still be able to access Web sites that present certificates signed by untrusted CAs, but users will always be warned that the Web site's certificate isn't trusted. (Note that this method works only on Windows XP systems and requires a Windows Server 2003 domain controller—DC).