Enroll for Certificates on Behalf of Other Users
It is not always possible for users to enroll for a certificate on their own behalf. This can be the case for a user smart card certificate. By default, only domain administrators are granted permission to request a certificate on behalf of another user. However, a user other than a domain administrator can be granted permission to become an enrollment agent. A user becomes an enrollment agent by enrolling for an Enrollment Agent certificate.
Once someone has an Enrollment Agent certificate, that person can enroll for a certificate and generate a smart card on behalf of anyone in the organization. The resulting smart card could then be used to log on to the network and impersonate the real user. Because of the powerful capability of the Enrollment Agent certificate, it is strongly recommended that your organization maintain very strong security policies for these certificates.
Membership in the Users group and an Enrollment Agent certificate are the minimum requirements to complete this procedure. Review the details in "Additional considerations" in this topic.
|To enroll for a certificate on behalf of other users
Open the Certificates snap-in for a user.
In the console tree, expand the Personal store, and then click Certificates.
On the Action menu, point to All Tasks, point to Advanced Operations, and then click Enroll on behalf of to open the Certificate Enrollment wizard. Click Next.
Browse to the Enrollment Agent certificate that you will use to sign the certificate request that you are processing. Click Next.
Select the type of certificate that you want to enroll for. When you are ready to request a certificate, click Enroll.
After the Certificate Renewal Wizard has successfully finished, click Close.
2016-07-29, 4151👍, 0💬
Certificate Summary: Subject: Internet Widgits Pty Ltd Issuer: Internet Widgits Pty Ltd Expiration: ...
How to open an encrypted DSA key file using OpenSSL "dsa" command? I was told the key file is DES en...
Certificate summary - Owner: *.mercadolibre.com.ar, IT, Mercadolibre S.R.L., L=Ciudad Autonoma de Bu...
Certificate summary - Owner: www.apple.com, Apple Inc., L=Cupertino, ST=CALIFORNIA, US Issuer: Cyber...
What can I use OpenSSL "genrsa" command for? What are options supported by the "genrsa" command? Ope...