When doing a registration, it will typically prompt you with two certificate windows. For scripting, it would make it easier if you could add an automatic yes to all switch for the zac reg command.
Otherwise you need to do something like:

\\networklocation\certmgr.exe -add -all \\networklocation\ca.der -s -r localMachine root

before running the zac reg. Which may require additional work in obtaining certmgr.exe, getting the ca.der file and having a network share set up to run it from.

This could potentially save time and frustration with hands off registration.