In this demonstration, we're going to deploy auto enrollment for certificates,
in particular, certificate templates.
We need to assign permissions in the template for read, enroll, and auto enroll.
Plus,
we have to go into the GPO and make some changes to that
in order to allow auto enrollment.
We are here on CA2, which is our subordinate enterprise CA.
I'm going to come up here to our console.
This console was previously built. It has certification authority,
it has the certificates for the local computer, and
finally, the certificate templates.
I'm going to actually add yet another snap‑in. This
one will be for Certificates,
click on Add, and this will be for my user account.
Click on Finish. Click on OK.
Now, we're going to see this how it doesn't work.
I'm going to go to Personal, and notice there are
no certificates inside of here.
I'm going to right‑click, All Tasks, Request New Certificate. And we get
a message saying Your computer has to be connected to the network and
your credentials, this is the key here, have to be proven to verify your
right to obtain the certificate.
I'm going to click on Next, and this is where we have our
Active Directory Enrollment Policy.
A couple of these certificates are available automatically,
and we'll go ahead and click on Next here.
The message that we see says that some certificates are predefined and
preconfigured for you, and we've done that; however,
notice it's not in here.
We do not have the CarvedRockUser certificate available to us.
Well, we're going to fix that.
Let's go ahead and click on Cancel.
And then we'll come up to our Certificate Templates and
examine the template that we want to give out.
It's right here CarvedRockUser.
I'm going to double‑click on it.
Go to Security, and notice Authenticated Users
don't have enroll and auto enroll.
Remember, they need read, enroll, and auto enroll.
So let's give them that here and here, and click on Apply, and then click on OK.
So the permissions on an individual certificate will tell if
people can actually get the certificate itself.
Let's go to our domain controller, DC1, and make changes to our
Group Policy. From DC1, we're going to come down here and we're
going to get here a slightly different way.
We're going to say PowerShell, hit Enter, and type in MMC. Now,
in this you need a specific snap‑in, and that snap‑in is down
here, Group Policy Management Editor.
We're going to click on Next, and this will take us
to one specific Group Policy.
The one we want is right here, CarvedRockRootCA.
We're going to click on OK, and then click on Finish, and then OK
yet again. I'm going to come down here, and there's two different
settings that we have for this, the User setting and the Computer
setting, depending upon if you're giving certificates to users or
computers, of course.
I'm going to come here to the User Configuration, go
to the Policies, Windows Settings,
Security Settings, and then finally Public Key Policies, and it's right
here, Certificate Services Client ‑ Auto Enrollment.
I'm going to double‑click on this, and instead of
Not configured, we select Enabled.
We want to check both these boxes to renew expired certificates and also
update certificates that use certificate templates.
We're going to click on Apply and then OK. Now, let's do the
same thing for the Computer Configuration.
We're going to go to Policies, Windows Settings,
Security, and from Security it's right down here, Public Key Policies. Same
thing. Double‑click on here, say it is Enabled, check that box,
check this box, click Apply, and then OK.
And there we have it.
Let's go back to CA2 and test this out. Inside of CA2, notice
Personal. There's nothing inside of here.
So, let's just go down to a command prompt, cmd, and refresh our Group Policy.
What I'm going to type in here is gpupdate, and this is going to be forced.
It goes through and it updates our computer policy and then it
updates our user policy. And when it updates a policy,
remember, we said auto update inside of our Group Policy, so it should add
this certificate to our user account inside of personnel.
Let's go give that a try. Minimize this in case we need it again. We
click on Personnel, right‑click, and say Refresh.
There it is.
I'm going to double‑click here, and there is our certificate.
It was issued to the administrator by carvedrockIssueCA, it has
the date right, and you can go into the Details and the
Certification Path and then click on OK.
And here, Certificate Template, CarvedRockUser,
the exact one that we wanted them to get.
Also notice here, Smart Card Logon that we added to this template.
So that is how you enable auto enrollment in a Windows Server 2022 in
Certificate Services to give all of your users the certificates that you
want to give them. Up next, we're going to learn how we revoke a certificate and then un‑revoke that same certificate.