Event details
would like to see an early June session with guidance on servers in DMZ and firewalled off so they not running windows update to get the certificates
How are you currently deploying your windows updates now? If it's through WSUS via SCCM we use the same utility. The registry key is what allows the certificates to be applied.
Assuming you are still applying patching to these servers manually, you would just have to apply the registry key, but Microsoft provides the High Confidence buckets for you to verify if they believe it is safe or not to apply.
