Collections:
Other Resources:
Manage Certificate Enrollment Policy by Using Group Policy
This topic describes the procedures and applications used to configure the certificate enrollment policy settings.
Configuring certificate enrollment policy settings by using Group Policy
Domain Admins is the minimum group membership required to complete this procedure.
☞ | To configure certificate enrollment policy settings in Group Policy |
Click Start, type gpmc.msc in the Search programs and files box, and press ENTER.
In the console tree, expand the forest and domain that contain the policy that you want to edit, and click Group Policy Objects.
Right-click the policy that you want to edit, and then click Edit.
In the console tree under Computer Configuration\Policies\Windows Settings\Security Settings, click Public Key Policies.
Double-click Certificate Services Client – Certificate Enrollment Policy. For more information about the settings in this dialog box, see the "Certificate Services Client – Certificate Enrollment Policy Properties dialog box" table later in this topic.
Click Add to open the Certificate Enrollment Policy Server dialog box. For more information about the settings in this dialog box, see the "Certificate Enrollment Policy Server dialog box" table later in this topic.
Do one of the following:
In the Authentication type list, select the authentication type required by the enrollment policy server.
Click Validate, and review the messages in the Certificate enrollment policy server properties area. The Add button is available only when the enrollment policy server URI and authentication type are valid.
Click Add.
✠| Note |
If the added enrollment policy server supports an enrollment policy that is already displayed in Certificate enrollment policy list, then the added server will not be displayed separately. Click Properties to verify that the added enrollment policy server is displayed in the Enrollment policy servers list. For more information about the settings in this dialog box, see the "Certificate Enrollment Policy Server Properties dialog box" table later in this topic. |
User interface reference
The following tables describe the settings available in the Certificate Services Client – Certificate Enrollment Policy Properties dialog box, the Certificate Enrollment Policy Server dialog box, and the Certificate Enrollment Policy Server Properties dialog box.
Certificate Services Client – Certificate Enrollment Policy Properties dialog box
Setting | Description |
---|---|
Configuration Model | Specifies whether the policy setting is enabled in Group Policy. |
Certificate enrollment policy list | Displays the list of enrollment policies that are included in the policy setting. One of the displayed policies must be specified as the default policy by selecting the Default check box. |
Add | Opens the Certificate Enrollment Policy Server dialog box, which is used to add an enrollment policy server. |
Remove | Removes the selected enrollment policy and all associated enrollment policy servers from the list. |
Properties | Opens the Certificate Enrollment Policy Server Properties dialog box, which displays the policy details and list of enrollment policy servers for the selected enrollment policy. |
Disable user configured enrollment policy | Disables the enrollment policy configured by users and applications. Only an enrollment policy configured in Group Policy is used. |
Certificate Enrollment Policy Server dialog box
Setting | Description | ||||
---|---|---|---|---|---|
Use default Active Directory domain controller URI | Specifies the default enrollment policy server LDAP URI and the Windows integrated authentication type. | ||||
Configure Friendly Name | This button is available only when Use default Active Directory domain controller URI is selected. Used to configure a name for the enrollment policy that is displayed instead of the default policy name or enrollment policy identifier. The specified name is seen by users in the Certificate Enrollment wizard and other applications.
| ||||
Enter enrollment policy server URI | Specifies the URI of the Certificate Enrollment Policy Web Service. The URI must use HTTPS. | ||||
Authentication type | Specifies the type of authentication that is used to connect to the specified URI. The specified authentication type must match the authentication type that is required by the Certificate Enrollment Policy Web Service. The following authentication types are available:
| ||||
Validate | Connects to the specified URI by using the specified authentication type to verify the following details:
Validation is required for an enrollment policy server URI before it can be added. If the specified URI and authentication type are valid, the enrollment policy identifier and friendly name are displayed. Warning or error messages are displayed if there is a problem with validation. | ||||
Add | Adds the enrollment policy server URI and validated enrollment policy to the Group Policy setting. The Add button is available only after the enrollment policy server URI and authentication type are validated. |
Certificate Enrollment Policy Server Properties dialog box
Setting | Description |
---|---|
Enrollment policy servers list | Displays the list of enrollment policy servers that support the enrollment policy. |
Remove | Removes the selected enrollment policy server. If all enrollment policy servers are removed, the enrollment policy will also be removed. |
Enable for automatic enrollment and renewal | Specifies that the enrollment policy is used for autoenrollment when autoenrollment is enabled. On computers running Windows 7 that are not members of a domain, autoenrollment is enabled by default. On computers that are members of a domain, autoenrollment must be enabled in Group Policy. See Managing Certificate Enrollment ( |
Require strong validation during enrollment | Specifies that enrollment clients require validation of the issuing CA's certification path during enrollment. |
Additional references
✍: Microsoft
2016-07-30, 5982🔥, 0💬
Popular Posts:
Certificate Summary: Subject: www.facebook.com Issuer: VeriSign, Inc., VeriSign International Server...
Certificate Summary: Subject: DigiCert Global Root G2 Issuer: DigiCert Global Root G2 Expiration: 20...
Certificate summary - Owner: Network Solutions Certificate Authority, Network Solutions L.L.C., US I...
Certificate summary - Owner: www.apple.com, ISG for Akamai, Apple Inc., STREET=1 Infinite Loop, L=Cu...
Certificate summary - Owner: *.b.ssl.fastly.net, "Fastly, Inc.", L=San Francisco, ST=California, US ...