New features
Offline / air-gapped deployment workflow
Two new flags enable a two-step workflow for machines that cannot reach the internet.
--download-only [DIR] - Download all certificates to a local folder without touching the registry. No admin rights required. Run this on any machine with internet access.
UpdateRootCertificates.exe --download-only
UpdateRootCertificates.exe --download-only D:\MyFolder
UpdateRootCertificates.exe --download-only "\\server\share\certs"
Omitting DIR saves to a RootCertificates subfolder in the current directory. Saves authroot.cab, authroot.stl, and all .crt files. Transfer the folder to the target machine via USB drive, network share, UNC path, or any other method.
--source <DIR> - Apply certificates from a folder produced by --download-only instead of downloading from Microsoft. Useful for offline, restricted, or air-gapped environments. Admin rights required.
UpdateRootCertificates.exe --source C:\path\to\folder
UpdateRootCertificates.exe --source D:\MyFolder
UpdateRootCertificates.exe --source "\\server\share\certs"