If you attempt to install a root Certificate Authority (CA) in Windows, you receive an error message that prevents you.
Microsoft Active Directory Certificate Services
Access is denied. 0x80070005 (WIN32: 5)
You must ensure all Enterprise Certificate Authorities (CA) are domain controllers.