How is the trusted root of an enterprise Certification Authority (CA) distributed to each domain computer when auto-enrollment is configured in an organization?