In this demonstration, we're going to create a key recovery agent.
We're going to make a custom key recovery agent certificate template,
request and issue that certificate.
This will be imported into the CarvedRockIssueCA,
and then we'll take a certificate template and make it auto
archive and then enroll in that certificate.
We are in CA2, we're logged in as administrator, a domain administrator.
I'm going to come here to the cr console,
double‑click it, open it up, and we'll have a look inside of here.
We're going to go to the Certificate Templates,
and inside of here we're going to have the Key Recovery Agent.
We could just use this one, however, I would like to modify it a little bit.
I'm going to right‑click it, say Duplicate Template,
and the first thing we're going to change is the actual name of this.
Instead of Copy of, we're going to say CarvedRock Recovery Agent.
I'm going to change the Compatibility too,
to Windows Server 2016, and change the recipient to 2016 as well.
And going to Security, we don't have to do anything here,
but I just want to show you that if you have a recovery
agent that isn't an administrator,
you're going to have to give them the Enroll capability right here.
However, see Domain Admins, they got Enroll,
and Enterprise Admins have Enroll as well.
So I'm going to click on Apply,
and that should set up this certificate for us to use.
I'm going to come up here to Certification Authority,
go to our carvedrockIssueCA, expand it.
We have our Certificate Templates here.
I'm going to right‑click and say New, Certificate Template to Issue.
Click on it, and we have it right here, CarvedRock Key Recovery Agent.
Click on it, and then say OK.
Now we can go to our user, which is logged in as Administrator,
so Current User is the Administrator, Personal,
go to All Tasks and say Request New Certificate.
Click on it, click on Next, and this is our Active Directory Enrollment Policy,
which should bring up that certificate that we made
available called CarvedRock Recovery Agent.
And here it is right here, CarvedRock Recovery Agent.
We're going to say Enroll, just takes a second, and click on Finish.
We still have another step, because under Pending Requests, there it is.
We right‑click this, go to All Tasks, and say Issue.
So we just issued that certificate to the Administrator
account that we're logged on with.
That allows the administrator to become a recovery agent.
The next step in the process, come down here to Personal,
go to Certificates, and we have our certificate right here,
Key Recovery Agent.
I'm going to right‑click and I'm going to say Open.
And we'll go to the Details tab and we're going to copy this to a file.
Then we can export it into our actual CA.
I'm going to say Yes, export the private key, and click on Next.
We'll take all this information for a PFX file, click on Next.
We are going to have a password here, and that password is going to be pw.
You can choose any password you'd like, however,
pw is what I have in the script for you to use so you
don't have to type all this stuff in.
I'm going to click on Next again.
And then the File name,
what we're going to do is we're going to just put it in
the root drive here and call it archive.
It will have the pfx extension, and then click on Save.
Click on Next, click on Finish, and the export was successful,
and then click on OK.
For this next part, we're going to go to PowerShell.
And I just come down here and say power for PowerShell,
click on PowerShell, and then we're going to come up here and type the following,
$pw, which is simply a string,
and then say ConvertTo‑SecureString ‑String "pw" ‑force ‑AsPlainText,
and that just puts that inside of that variable.
Now, we come here and type in this, Import‑pfxCertificate,
the ‑FilePath, and we can see the FilePath here,
the cert:\localmachine, and then the password is going to be $pw.
This automatically hit Return when I copied it in,
but you can see that, wow, this has been imported,
so we're all ready to go on that.
I'm going to minimize this because we're going to need it again.
Now we are ready to actually make the certificate that
we're going to archive automatically.
So I'm going to come here to Certificate Templates,
and we're going to go to CarvedRock User,
right‑click it, and say Duplicate Template.
I'm going to change the name of this to CarvedRock User,
and then say Archive so we can distinguish it from CarvedRock User.
And then here is the key.
Go to Request Handling,
and right here where it says Archive subject's encryption private key.
We check that,
and we have just enabled archiving for this particular certificate.
Now, we're going to get this, which says,
you know, I have not issued any of these certificates before,
so this is only going to take effect going forward,
meaning that if we had issued other certificates
matching this certificate template, they're not going to be auto archived,
and we know that, and we're okay with that,
so we're going to click on OK.
I want to come up here to the Subject Name,
because if you are using an older version of the certificate,
this Include e‑mail name in subject name and this,
Include that information for the E‑mail name,
is going to be included in that certificate.
If you did not modernize this with the compatibility setting,
then you're going to have to come in here,
manually undo or uncheck those two boxes,
or you're not going to be able to enroll in this certificate
because you don't have an e‑mail name.
If you have email, don't worry about it.
I'm going to click on Apply, I'm going to click on OK again.
Now, you probably know the routine.
We're going to right‑click on Certificate Templates,
say New, Certificate Template to Issue, and it's right down here,
CarvedRock User Archive.
We're going to click on OK.
And now we're going to go to the actual properties of our Certificate
Authority by right‑clicking and saying Properties.
And we go to this tab right here that says Recovery Agents.
This is why we imported that key.
And by clicking on here where it says Archive the key,
we can add the recovery agent.
So we say Add, we only have one issued certificate now,
otherwise,
you would have to come through here and choose which
certificate is the recovery agent.
We only have one, so we'll click on OK.
We can come down and click on Apply, and it says,
hey, you have to restart Certificate Services,
we're okay with that.
Now notice, it says not loaded up here,
and it's going to load this when it is finished
restarting the Certificate Services.
And we can see the Status is Valid.
I'm going to click on OK here.
And we come back up here to CarvedRock, and we see it right here.
Here is the certificate, and the Archive should be there, and we're going to delete and then recover this key next.