I found on some occasion you can't import a third party root ca (to the trusted zone) when you run certmgr.msc,
But if I add a mmc control manually and select "Computer account", the import procedure was successful.
So anyone know the difference between them?