So to create the certificate auto‑enrollment Group Policy Object,
or GPO,
we're going to jump back over to our domain controller, and once again,
this goes without saying, if you have the remote server administration
tools installed on a Windows 10 workstation,
Windows 11 workstation, that works just as well.
I'm going to do it here on the domain controller, but we're going
to open the Group Policy Management console, and to do that I just
have a shortcut here on my task bar, but you can always just type
in group policy, and you'll find the Group Policy Management
console there as well.
The first thing I'm going to do is right‑click on Group Policy Objects and
choose New, and then I'm going to give this a descriptive name,
click OK.
Then I'm going to find this Group Policy Object that I just
created. I'm going to right‑click and choose Edit.
The first thing I want to do is enable enrollment for computer
certificates, and to do that, I'm going to select Policies, I'm
going to expand Windows Settings, Security Settings, and Public Key Policies.
So highlight Public Key Policies and double‑click on
Certificate Services Client ‑ Auto‑Enrollment.
The Configuration Model will be Enabled, and then I'm going to check the
box to Renew expired certificates, update pending certificates, and
remove revoked certificates, and I'm also going to select the option to
Update certificates that use templates.
So we'll click OK.
And then I'm going to repeat the process for user certificates as well.
So here we'll expand User Configuration, Policies, Windows Settings,
Security Settings,
Public Key Policies, and double‑click Certificate Services Client ‑
Auto‑Enrollment. So we'll select Enabled, Renew, Update, and click
OK. So we'll close the GPO, and again,
I recommend assigning this at the domain so it's as easy as just
dragging and dropping on the domain, but again,
if you are unable to do that for any reason,
the ultimate objective is to make sure that this certificate
auto‑enrollment policy gets to our VPN servers, our NPS servers,
our VPN users, and our VPN devices.
So if you need to link this GPO to a specific OU in your
organization or do some security filtering,
it's up to you. At the end of the day, it just needs to get
to, again, our VPN users and devices,
our VPN servers, and our NPS servers. And once that's done,
your NPS servers along with your VPN users and devices will
automatically enroll, and importantly, automatically renew
those certificates before they expire.
Also, your VPN servers,
as I had mentioned before, although they can't take advantage of the
auto‑enrollment because we have to supply the name and the request,
they will be able to renew themselves next year when they expire, which is a huge win obviously for administrators.