Deleting CAs From System-wide Trust-list

In our enterprise, one of the security lockdowns applied to Windows systems is the removal of all but a few, especially-trusted public CAs (along with adding internal CAs to the trust-list).

It's easy enough to add CAs to the host-wide trust-list, but I'm having a heck of a time finding adequate tutelage via Google. I'd tried using

certutil

certutil

Our systems auditors haven't come hunting, yet, for us to align the Red Hat systems' CA trusts with our Windows systems (probably because the verification tools in OpenSSL tend to suck - particularly when it comes to bundles). But, if they do come for my Red Hat systems, I want to have a easily scriptable fix ready to go.

Halp?