All right, let's get on to the first demonstration,
and we'll configure our first NPS server.
So here we are in our virtual machine that we've provisioned to support NPS.
This server has been joined to the domain.
It's been named accordingly.
It's all configured and ready to go.
And as I mentioned before,
the first thing we need to do before we start doing any configuration here is
just make sure that our certificates came over correctly.
To do that, I'm going to open up the Local Computer Certificates store,
and the best way to do that, honestly,
is by just clicking on the Start button or even entering in
the search field the phrase certlm.msc, and that will bring us to this shortcut.
And there we have it.
We are in the Local Computer Certificates store.
We didn't have to do all of the add, remove, snap‑in stuff.
So we're going to expand our Certificates,
Personal, and here you'll notice that we do not have any certificates configured.
Now, if you'll remember back to one of the previous modules,
we did all the certificate template configuration.
We defined our auto enrollment policy.
This is a domain‑joined server.
It should be here, but it is not,
so let's do a quick bit of troubleshooting and find out what's up.
First thing I'm going to do is I'm going to run a gpresult,
so I'm going to open an elevated PowerShell command window,
and you can do this from the command window as well.
I prefer to do everything from PowerShell though.
So I'm going to right‑click on the Start menu and then choose
PowerShell (Admin) as it needs to be elevated.
And the first thing I want to do here is run gpresult, and
let's see what group policies we have.
And once again,
the command here is gpresult /r and then /scope computer because I'm not
interested in any of the user Group Policy settings.
So once that's done,
I'm going to scroll up, and the first thing I'm looking for is my
Certificate Auto Enrollment Group Policy has been applied. Interesting
because I still don't have a certificate.
If I look here in the computer is a part of the following security
groups, what I am not seeing here is this NPS server being a member
of the NPS Servers security group, which if you recall,
is what we defined for the security ACL on the template
for that certificate for NPS servers.
So I'm going to run over to my domain controller, I'm
going to add this server to the group, and then we'll
reboot this server because, again,
its security group membership changed, so it has to restart.
Once I've rebooted the server,
I'm going to come back in here and look at this and make sure that my
certificate gets installed correctly. And just like that, we're back.
So I've added this server to the NPS Servers security group in
Active Directory and restarted, so now let's take a look at our
settings and see if we've got this certificate.
So once again, I'm going to open up the PowerShell command window.
So I'm going to run gpresult again, and let's see what the output is.
And here you'll see that the NPS server is now a member of the NPS
Servers group, so I should have a certificate.
Let's open up the Local Computer Certificates store again, and you can just run
this command right from the command window if you'd like.
We'll expand our Personal store, and lo and behold we have a certificate.
Let's take a quick look at it.
So here's our certificate, correct hostname, private key.
No issues with the certification path.
Everything looks fantastic. We are now good to go, and we can start to install the NPS Roll