Credential roaming allows organizations to store certificates and private keys in Active Directory Domain Services (ADÂ DS) separately from application state or configuration information.
How credential roaming works
Credential roaming uses existing logon and autoenrollment mechanisms to securely download certificates and keys to a local computer whenever a user logs on and, if desired, remove them when the user logs off. In addition, the integrity of these credentials is maintained under any conditions, such as when certificates are updated and when users log on to more than one computer at a time.
The following steps describe how digital credential roaming works.
Newly issued certificates are stored in the certificate store on the client computer and replicated to ADÂ DS.
In multi-domain environments and domains with multiple domain controllers, credentials may not be immediately available when a user logs on to the network by using one domain controller shortly after being issued a certificate on a computer that validates the user's identity against a different domain controller. The credentials will only become available after replication has been completed between the two domains or domain controllers.
Credential roaming is triggered any time a private key or certificate in the user's local certificate store changes, whenever the user locks or unlocks the computer, and whenever Group Policy is refreshed.
All certificate-related communication between components on the local computer and between the local computer and ADÂ DS is signed and encrypted.
2016-07-17, 5165👍, 0💬
How can I use Microsoft "certutil -addstore" command? What are command options supported by "certuti...
How to see the list of trusted root Certification Authorities (CA) and their certificates used by Go...
How to convert a certificate file in PEM (Privacy Enhanced Mail) format to DER (Distinguished Encodi...
Certificate Summary: Subject: GlobalSign Issuer: GlobalSign Expiration: 2021-12-15 08:00:00 UTC Key ...
Where can I get a good sample configuration file openssl.conf for OpenSSL "req" command? Below is a ...