Which of the following CA types must be deployed on domain-joined computers?