Use a text editor to open the file <KCA-install-dir>/WebServer/enroll-server/get-cert-msie.xuda, and look for the following lines:

  <P> Where is this certificate being installed?
  <SELECT NAME="USERPROTECT">
  <OPTION VALUE="0" SELECTED>Personal store</OPTION>
  <OPTION VALUE="1">Local machine store</OPTION>
  <OPTION VALUE="2">Smart Card</OPTION>
  </SELECT>
  </P>

To change the default selection to 'Smart Card', change the above lines so they look like the following:

  <P> Where is this certificate being installed?
  <SELECT NAME="USERPROTECT">
  <OPTION VALUE="0">Personal store</OPTION>
  <OPTION VALUE="1">Local machine store</OPTION>
  <OPTION VALUE="2" SELECTED>Smart Card</OPTION>
  </SELECT>
  </P>

Save the changes.  All users will get 'Smart Card' as the default option to install the renewed certificate to.