certutil.exe -addstore Disallowed sst

Hi

during the security scan the tool found that

HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates\e1f3591e769865c4e447acc37eafc9e2bfe4c576 is missing

due to servers don't have access to internet and doesn't download CLT. I follow the link:

https://technet.microsoft.com/en-us/library/dn265983.aspx#BKMK_PrepServer

but it descirbes how to create subset of trusted cert and i need to create subset on UNtrusted cert.

I also tried using certutil but got the following

C:\Users\xxx>certutil -addstore Disallowed \\xxx\source\ctl\disal
lowedcert.sst
Disallowed
CertUtil: -addstore command FAILED: 0x8009310b (ASN: 267)
CertUtil: ASN1 bad tag value met.