If there is no local admin or background access, roll back the Feature update in recovery.
Otherwise, export and import: HKLM\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates
$hivefile = "C:\Windows.old\WINDOWS\System32\config\SOFTWARE" $regfile = "C:\MyCertificates.reg" REG LOAD "HKLM\SOFTWARE_TEMP" $hivefile REG EXPORT "HKLM\SOFTWARE_TEMP\Microsoft\SystemCertificates\MY\Certificates" $regfile REG UNLOAD "HKLM\SOFTWARE_TEMP" ((Get-Content -path $regfile -Raw) -replace "SOFTWARE_TEMP", "SOFTWARE") | Set-Content -Path $regfile REG IMPORT $regfile