We have a Microsoft enterprise certificate authority, and I would like to start issuing a few code signing certificates.
But what I'm unsure of is this: since all our domain/forest machines trust the internal CA, when I issue code signing certificates: will all the client systems automagically trust the code signing certs for executing any code, or do I need to add the individual users' code signing certs to the clients' "Trusted People" store (like you might do with their self-signed or third-party certs)?
Best Answer
If you issue the certificates using a trusted CA, then all these certificates will be trusted by your machines. You can have a look at this page.