Your network contains an Active Directory domain named contoso.com. The domain contains a server named
Server1 that runs Windows Server 2012.
Server1 is the enterprise root certification authority (CA) for contoso.com.
You need to enable CA role separation on Server1.
Which tool should you use?

A.
The Certutil command

B.
The Authorization Manager console

C.
The Certsrv command

D.
The Certificates snap-in

Explanation:
To enable role separation
Open Command Prompt.
Type:
certutil -setreg ca\\RoleSeparationEnabled 1
Etc.
Enable role separation