In this demonstration, we're going to create an enrollment agent.
This gives any user the ability to enroll other devices
or other entities to a certificate.
We're going to prepare a template, make the template available,
and then enroll our agent with the enrollment agent template.
This is Domain Controller 1,
and what we're going to do is go in and create a user
account that will act as our enrollment agent.
I'm going to come down here to Server Manager,
a lot of different ways you can get here,
but I'm going to go to Active Directory Users and Computers. Click on it, we'll
go ahead and expand this, and what I'm going to do is I'm going to actually
create a new organizational unit, call this agents.
This is not a necessary step,
but I like organizing my Active Directory. I'm going to click on OK,
and within this OU we're going to say New, User. We'll call this,
just making up stuff here, Fred Parsons.
We'll just call him fp for Fred Parsons, and then click on Next. We don't
want them to change the password at the next logon, so I'm going to uncheck
this, and then add our password and click on Next.
Review this, and then click on Finish.
So now, fp is a user in here, and notice we did not give any
administrator rights to this individual user.
Now let's go to CA2. In CA2, we already have our
console open and we're all ready to go.
I'm going to go to Certificate Templates, and right down here we
have Enrollment Agent, this one is for Computers, and an
Enrollment Agent, this one is for Users.
We're going to take the one for Users.
We're going to right‑click and say Duplicate Template, because this
is Schema Version 1, we have to do this. Inside of here, first thing
I'm going to change is the name of it.
I'm going to call this CarvedRoot Enrollment Agent. And then we
come to the Security, and from Security we need to add fp to this,
so I'm going to just say fp, and we're going to Check Names, and
sure enough, there they are.
Now we need to give fp, or Fred Parsons, Enrollment, as well as
Read for this particular certificate template.
I'm going to click on Apply and click on OK.
One last thing we need to do is come down here and type in
users, and then Edit local users and groups.
We do this to allow Fred to log onto this machine on a remote desktop basis.
So we have Groups, and then right under here, under our Remote Desktop Users.
Double‑click it, we're going to Add, and type in fp yet again. Check the names,
and we got it right, click on OK. Click on Apply,
click on OK yet again.
Now, what we've done is we've changed the template
properties and we've allowed fp, or Fred Parsons, to be
able to log onto this machine remotely.
So let's do that now. We're going to sign out as administrator.
We'll go to Other user and type in f and a p, the password, I have that
on quick dial, and we're all logged in. Now, we don't have our
Management Console, so we have to recreate that.
I'll come up here to File,
Add/Remove Snap‑in, and this is going to be a certificate for the Current
User, and then click on OK. Expand this to see it better, expand
Certificates, and go to Personal, right‑click, All Tasks,
Request New Certificate. Click on Next, we've been through this before,
click on Next again, and there it is, CarvedRoot Enrollment
Agent. And simply come down here and say Enroll.
It goes through and, remember, fp, or Fred Parsons, has the enrollment right
to this certificate, and by taking this certificate, that makes them an
enrollment agent on our certification authority.
I'm going to click on Finish, we go up to Certificates, and we can see
Fred automatically got our auto‑enroll certificate, and Fred also has
this certificate for Certificate Request, so that is how you make an enrollment agent in Windows Server 2022.