There are informational entries in the agent logs and you would like to know what some of it means. For example:
Informational logging that says the certificates were restored.
Some certificates were overwritten in "Intermediate Certification Authorities' store.
A Certificate was overwritten in the ' Trusted Root Certification Authority"
Periodic certificate validation started.
Failed to restore the certificates...
Validating certificate store...
How does this process of certificate management work?
Release : 8.x
Certificate integrity validation
The current system provides some integrity mechanisms – every time SMA adds or modifies any certificate it also performs Windows certificate store backup. The backup copy is saved into SMA secure storage in "AgentCore\CertificateStoreBackup\N" folders where N is the internal certificate store ID. Certificate store backup copy is stored as a binary blob, no private keys are stored in there. Later when SMA needs to perform some certificate related operations like agent registration, CEM certificate retrieval, site server certificate retrieval it first validates if Windows certificate stores have all SMA certificates from the backup. If some certificate is missing SMA first restores them from the backup copy. SMA also performs the periodic certificate validation – every 3 hours SMA compares the backup copy of the certificate stores with the actual certificate stores and restores the missing or modified SMA certificates. The same validation is performed during SMA startup. This scenario is important for Windows 10 upgrade scenarios where Windows 10 upgrade does not migrate the content of SMA server personal store "AeXNSClient\Personal", in this scenario the store content will be restored by SMA upon startup after Windows 10 upgrade is completed.
The whole certificate store backup is replaced by individual certificate backup. The backup location is "AgentCore\CertificateBackup\N\thumbprint", where N is the store ID and "thumbprint" is the actual certificate thumbprint.
Certificate Stores used by SMA
SMA installs various certificates in different stores, specifically:
No other stores are used by SMA.
Regarding the questions. Remember that these are informational messages and there are no problems at all.
Regarding SMA service private store - only CEM certificates are stored there. This is just an additional security step to isolate those certificate from accidental removal. If machine is in CEM mode and those certificate removed then machine would loose connection to NS. This store is used since the very first release of CEM.