Default domain policy

• Allow users to select new root certification authorities (CAs) to trust
• Client computers can trust the following certificate stores
• To perform certificate-based authentication of users and computers. CAs must meet the following criteria.

But, when Edit the Default Domain policy (tried it on Windows 7 PC, Windows Server 2012), there is no polices listed under Public Key Policies/Trusted Root Certification Authorities

In fact there is no policies (none) listed in this section.

Question: How can we edit these x3 policies? 

thank you