The first ot root server in a PKI must have the Active Directory Certificate Services installed running which role service?
Network Device Enrollment Service
Certification Authority Web Enrollment
Online Responder
Certificate Authority