Auto Enrollment of User Certificate in Active Directory | Active Director... http://www.w7cloud.

com/auto-enrollment-of-user-certificate/

HOME (HTTP://WWW.W7CLOUD.COM) WINDOWS SERVER 2008 R2 (HTTP://WWW.W7CLOUD.COM/CATEGORY/WINDOWS-SERVER-2008-R2/) Contact Us (http://www.w7cloud.com/contact-us/)

TECH ARTICLES (HTTP://WWW.W7CLOUD.COM/CATEGORY/TECH-ARTICLES/) CLOUD COMPUTING (HTTP://WWW.W7CLOUD.COM/CATEGORY/CLOUD-COMPUTING/)

HTTP://WWW.W7CLOUD.COM/CATEGORY/CERTIFICATIONS/) NETWORK SOLUTIONS (HTTP://WWW.BURAQTECH.COM/)

ACTIVE DIRECTORY (HTTP://WWW.W7CLOUD.COM/CATEGORY/WINDOWS-SERVER-2008-R2/ACTIVE-DIRECTORY/) // type your search here

Mar WINDOWS SERVER 2008 R2 (HTTP://WWW.W7CLOUD.COM/CATEGORY/WINDOWS-SERVER-2008-R2/)

13 Auto Enrollment of User Certificate in Active Directory

013

An article by Waqas Azam 2 Comments (http://www.w7cloud.com/auto-enrollment-of-user-certificate

Follow Us on Twitter!
/#comments)
(http://twitter.com/w7cloud)

Like Find us on Facebook

In Auto enrollment certificates are distributed automatically by certificate authority and user even not being aware W7cloud
that certificate enrollment is taking place. Normally certificates issued to computers and services are done by auto Like

enrollment.
27 people like W7cloud.
Here I will show you how you can auto enroll the user certificate using certificate authority in active directory. You
need the following step to accomplish this task:

Create and configure the Duplicate Template

Assign read and write and Auto enroll Permissions

book.com/sharer.php)

Publish the Certificate

Facebook social plugin
Create a Group Policy for auto enrollment

For better understanding I want to share my network topology with you, I am using three systems for this task.

1. Domain controller: w7cloud.com

2. Certificate Authority Server: (ca.w7cloud.com) AD certificate services (http://www.w7cloud.com/active-

directory-certificate-services-pki-hierarchy/) installed on it. You can learn more about installing Certificate
services (http://www.w7cloud.com/installing-ad-certificate-services-role/).

3. W7-client: (w7-client.w7cloud.com) where we will test auto enrollment of the user certificate.

Create and configure the Duplicate Template:

Go to certificate templates and create a duplicate template for user certificate by right clicking on user certificate,
select windows server 2008 (as my clients are using windows 7) and give some name to this certificate. Creating
Duplicate Template is also define in Key Archiving in Certificate services (http://www.w7cloud.com/configure-auto-
matic-key-archiving-in-certificate-services-key-recovery-agent/) you can visit this for reference.

Once you create a duplicate certificate it will ask you for some setting and configuration, you can choose the setting
according to you requirements but following are some important setting that you should keep in mind while creating
duplicate user certificate template.

1 of 6 5/17/2014 10:02 PM
Auto Enrollment of User Certificate in Active Directory | Active Director... http://www.w7cloud.com/auto-enrollment-of-user-certificate/

(http://w7cloud.com/wp-content/uploads/2013/03/User-Template-proper-
ties11.gif)

For example select the purpose of user certificate, I choosing signature and encryption.

(http://w7cloud.com/wp-content/uploads/2013/03/Purpose-of-user-tem-
plate-certificate21.gif)

From cryptography tab you can select the encryption type according to your choice. I am using RSA with 2048bit
key size. RECENT POSTS

Be careful while selecting different checkboxes from Subject Name tab if you dont specify the email for users
then it is better that you dont select the email checkbox otherwise this client or user may not receive the certificate. How to protect/Lock a folder in windows
7 or windows 8:
(http://www.w7cloud.com
/how_to_protect_lock_folder_windows_7_win

Software Engineering Interview

Questions and Answer
(http://www.w7cloud.com
/software_engineering_interview_questions_a

English Vocabulary Quiz | Test your

English knowledge
(http://www.w7cloud.com/english-
vocabulary-quiz-test-your-english-
knowledge/)

Switching Quiz Questions and Answers

(http://www.w7cloud.com/switching-
(http://w7cloud.com/wp-content/uploads/2013/03/Subject-name-certifi-
quiz-questions-and-answers/)
cate31.gif)

Other important thing for user template is to assign the enroll and Autoenroll right to domain users from security BGP Quiz Border Gateway Protocol
tab so that domain user can get certificates. Questions and Answers
(http://www.w7cloud.com/bgp_quiz/)

TAGS

active dirctory (http://www.w7cloud.com

/tag/active-dirctory/) Active

2 of 6 5/17/2014 10:02 PM
Auto Enrollment of User Certificate in Active Directory | Active Director... http://www.w7cloud.com/auto-enrollment-of-user-certificate/
Directory
(http://www.w7cloud.com
/tag/active-directory/)
ADSL (http://www.w7cloud.com/tag/adsl/) AS
LDS (http://www.w7cloud.com/tag/as-lds/)
backup and recovery (http://www.w7cloud.com
/tag/backup-and-recovery/) Broadband Internet
(http://www.w7cloud.com/tag/broadband-

internet/)

(http://w7cloud.com/wp-content/uploads/2013/03/right-assignment1.png)
certificate
Click Apply and ok and you will find your certificate in certificate template under your CA server.
services
Publish the Certificate (http://www.w7cloud.com
/tag/certificate-services/)
CISCO
(http://www.w7cloud.com
/tag/cisco/) Commands
(http://www.w7cloud.com/tag/commands/)
conditional forwarder (http://www.w7cloud.com
content network
/tag/conditional-forwarder/)
(http://www.w7cloud.com/tag/content-
network/) DNS
(http://www.w7cloud.com/tag/dns/) DSL
(http://www.w7cloud.com/tag/dsl/) Frame
relay (http://www.w7cloud.com
/tag/frame-relay/) GPO
(http://www.w7cloud.com
/tag/gpo/) installation
(http://www.w7cloud.com/tag/installation/)

Inter-controller Roaming
To add this certificate to active directory users, right click on certificate template under your domain and click on new
(http://www.w7cloud.com/tag/inter-
certificate template to issue. And select your user certificate from certificate list.
controller-roaming/) IP
(http://www.w7cloud.com
/tag/ip/) IPv6
(http://www.w7cloud.com

/tag/ipv6/)

(http://w7cloud.com/wp-content/uploads/2013/03/Issue-
certificate-to-active-directory1.png)

Right Click on domainproperties and then from Recovery Agent tab select archive this key and add your certificate
from add button.
networking
quiz
(http://www.w7cloud.com
/tag/networking-quiz/)

(http://w7cloud.com/wp-content/uploads/2013/03/Archive-
the-user-key1.gif)

3 of 6 5/17/2014 10:02 PM
Auto Enrollment of User Certificate in Active Directory | Active Director... http://www.w7cloud.com/auto-enrollment-of-user-certificate/

Create a Group Policy: Network

Now I have created a group policy for auto enrollment of user certificate for active directory user. You can create a model
group policy by right click on your required domain from features/group policy management and choose the first op-
tion Create a DPO in this domain and link it here. You can learn how to add/create Group Policy in Active Directory (http://www.w7cloud.com
/tag/network-model/)
network principles
(http://www.w7cloud.com
/tag/network-principles/)
Network Security
(http://www.w7cloud.com
/tag/network-security/) OSI model
(http://www.w7cloud.com/tag/osi-
model/) PPDIOO

(http://w7cloud.com/wp-content/uploads/2013/03/Create-
(http://www.w7cloud.com
a-group-policy-for-autoenrollment-in-active-directory1.gif) /tag/ppdioo/) Quiz
Choose a name for GPO and click on OK. Now right click on newly create Group Policy and click on Edit for defin- (http://www.w7cloud.com
ing your own setting.
/tag/quiz/) roaming
(http://www.w7cloud.com
/tag/roaming/) Routing

Protocols
(http://www.w7cloud.com
/tag/routing-protocols/)
(http://w7cloud.com/wp-content/uploads/2013/03/Edit- server 2008
GPO1.gif)
(http://www.w7cloud.com
From user configurationpolicieswindows settingssecurity settingsPublic key policies enable Certificate Ser-
vices Client-Auto Enrollment.
/tag/server-2008/) Server
2008 R2
(http://www.w7cloud.com
/tag/server-2008-r2/) server
features (http://www.w7cloud.com
/tag/server-features/) Switch network
(http://www.w7cloud.com
/tag/switch-network/) Throughput
(http://www.w7cloud.com/tag/throughput/)
Virtualization (http://www.w7cloud.com
/tag/virtualization/) vmware
(http://w7cloud.com/wp-content/uploads/2013/03/Enable-Au-
toenrollment-for-user-certificate1.gif) (http://www.w7cloud.com/tag/vmware/) VPN
(http://www.w7cloud.com/tag/vpn/)
Now for test login into your client using a domain user and open MMC and add the snap-in from file menu and add
WAN (http://www.w7cloud.com
the certificate snap-in and click OK. There in personal/certificate folder you will find your user certificate.
/tag/wan/) WAN protocols
(http://www.w7cloud.com/tag/wan-
(http://w7cloud.com/wp-content/uploads/2013/03/user-certifi- protocols/) WAN Solutions
cate-on-client-MMC1.gif) (http://www.w7cloud.com
Note: You may not find the certificate at your first login into client machine, you can try following steps for trou- /tag/wan-solutions/) wifi
bleshooting:
(http://www.w7cloud.com
Restart client computer /tag/wifi/) wireless Design
Run the command GPUPDATE and certutil pulse in administrator command prompt. (http://www.w7cloud.com
/tag/wireless-design/) wireless
network
(http://www.w7cloud.com
/tag/wireless-network/)

4 of 6 5/17/2014 10:02 PM
Auto Enrollment of User Certificate in Active Directory | Active Director... http://www.w7cloud.com/auto-enrollment-of-user-certificate/

ARCHIVES

February 2014
(http://www.w7cloud.com/2014/02/)

December 2013
(http://www.w7cloud.com/2013/12/)

November 2013
(http://www.w7cloud.com/2013/11/)

August 2013 (http://www.w7cloud.com

/2013/08/)

July 2013 (http://www.w7cloud.com

/2013/07/)

March 2013 (http://www.w7cloud.com

0
/2013/03/)
Like
February 2013
(http://www.w7cloud.com/2013/02/)
Tags: Active Directory (http://www.w7cloud.com/tag/active-directory/), certificate services January 2013 (http://www.w7cloud.com
(http://www.w7cloud.com/tag/certificate-services/), server 2008 (http://www.w7cloud.com/tag/server-2008/) /2013/01/)

December 2012
Did you enjoy this article? Share it! (http://twitter.com/home/?status=Auto Enrollment of (http://www.w7cloud.com/2012/12/)

User Certificate in Active Directory : http://www.w7cloud.com/auto-enrollment-of-user-certificate/) November 2012

(http://www.stumbleupon.com/submit?url=http://www.w7cloud.com/auto-enrollment-of-user- (http://www.w7cloud.com/2012/11/)

certificate/&title=Auto Enrollment of User Certificate in Active Directory) (http://digg.com

/submit?phase=2&url=http://www.w7cloud.com/auto-enrollment-of-user-certificate/&
title=Auto Enrollment of User Certificate in Active Directory) (http://del.icio.us/post?url=http:
CATEGORIES
//www.w7cloud.com/auto-enrollment-of-user-certificate/&title=Auto Enrollment of User
Certificate in Active Directory) (http://www.facebook.com/sharer.php?u=http:
Active Directory
//www.w7cloud.com/auto-enrollment-of-user-certificate/&t=Auto Enrollment of User Certificate in
(http://www.w7cloud.com/category
Active Directory)
/windows-server-2008-r2/active-
directory/)

Related Posts CCDA (http://www.w7cloud.com

WLAN Security | The Best
Practices
(http://www.w7cloud.com
/wireless_lna_security_the_best_practices/)
Enable Remote Login to AD
Users/Group using Restricted
Group GPO
(http://www.w7cloud.com/enable-remote-
login-to-ad-usersgroup-using-restricted-
group-gpo/)
/category/certifications/ccda/)
GPO Filters | Search Policies
Cloud Computing
using filter in windows server
(http://www.w7cloud.com/category
2008 (http://www.w7cloud.com
/cloud-computing/)
/gpo-filters-search-policies-using-filter-
in-windows-server-2008/) Network Certifications
(http://www.w7cloud.com/category
/certifications/)
Exclude users from GPO
(http://www.w7cloud.com/exclude- Networking Terms
users-from-gpo/) (http://www.w7cloud.com/category/tech-
articles/networking/)
Quiz (http://www.w7cloud.com/category
/tech-articles/quiz/)

Tech Articles (http://www.w7cloud.com

About the Author: Waqas Azam ()
/category/tech-articles/)

Uncategorized (http://www.w7cloud.com
/category/uncategorized/)

Virtualization (http://www.w7cloud.com
/category/virtualization/)
+ ADD COMMENT
2 Comments Windows Server 2008 R2
(http://www.w7cloud.com/category
/windows-server-2008-r2/)

voffka July 9, 2013 at 12:47 pm

5 of 6 5/17/2014 10:02 PM
Auto Enrollment of User Certificate in Active Directory | Active Director... http://www.w7cloud.com/auto-enrollment-of-user-certificate/
But the new template does not appear with NEW certificate template to issue. It is empty .

Waqas Azam July 10, 2013 at 3:42 pm

You may not find the certificate at your first login into client machine, you can try following steps for
troubleshooting:

Restart client computer

Run the command GPUPDATE and certutil pulse in administrator command prompt.

Leave a comment
Name (required)

Mail (will not be published) (required)

Website

Comment

POST COMMENT

Created by Buraq Tech (http://www.buraqtech.com/). Experts in Web Development (http://www.buraqtech.com/web-solutions).

Copyright 2013 w7cloud.com. All rights reserved.

6 of 6 5/17/2014 10:02 PM