How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

Today, I am going to show you how to configure Server Certificate Auto-enrollment via Group Policy, you need to have an Enterprise certification authority root server before you configure auto-enrollment, if you don’t know how to install Enterprise certification authority root server, you can follow my previously post and step by step to install it.

  1. Login to Certificate Authority server.
  2. On the Server Manager page, select Tools and click Certification Authority.

    012720 1833 HowtoConfig1 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  3. On the Certificate Authority page, select your Domain and click Certificate Templates, There are some exiting templates by default, I am going to use Computer (it’s intended purpose for Client Authentication and Server Authentication) template for server certificate auto-enrollment, you also can create (duplicate) a new certificate for it.

    012720 1833 HowtoConfig2 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  4. Before we are starting to configure server certificate auto-enrollment, select Issued certificates, you will notice there is no existing certificate be issued.

    012720 1833 HowtoConfig3 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  5. Login to the Domain controller server.
  6. On the Server Manager page, select Tools, click Group Policy Management.

    012720 1833 HowtoConfig4 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  7. On the Group Policy Management page, right-click Group Policy Object and select New.

    012720 1833 HowtoConfig5 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  8. On the New GPO enter Auto Enrollment for Computer Certificate Policy as Name, click OK.

    012720 1833 HowtoConfig6 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  9. Right-click the Auto Enrollment for Computer Certificate Policy, select Edit.

    012720 1833 HowtoConfig7 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  10. On the Group Policy Management Editor page, expand Computer Configuration àPolicies àWindows Settings àSecurity Settings, select Public Key Policies and double click Certificate Services Client – Auto-Enrollment.

    012720 1833 HowtoConfig8 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  11. On the Certificate Services Client – Auto-Enrollment page, change Configuration Model form Not configured to Enable.

    012720 1833 HowtoConfig9 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  12. On the Configuration Model, select Renew expired certificate, update pending certificates, and remove revoked certificates.
  13. On the Configuration Model, select Update certificates that use certificate templates. Click OK.

    012720 1833 HowtoConfig10 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  14. On the Policy Key Policies, right-click Automatic Certificate Request Settings, select New.

    012720 1833 HowtoConfig11 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  15. On the Welcome to the Automatic Certificate Request Setup Wizard page, click Next.

    012720 1833 HowtoConfig12 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  16. On the Certificate Template page, select Computer, click Next.

    012720 1833 HowtoConfig13 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  17. On the completing the Automatic Certificate Requests Setup Wizard page, make sure setup successfully, click Finish.

    012720 1833 HowtoConfig14 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  18. On the Automatic Certificate Request Settings, make sure the Computer certificate is showing and close Group Policy Management Editor.

    012720 1833 HowtoConfig15 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  19. On the Group Policy Management page, right-click your local domain name (or the Server OU), select Link an Existing GPO.

    012720 1833 HowtoConfig16 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  20. On the Select GPO page, select Auto Enrollment for Computer Certificate Policy, click OK.

    012720 1833 HowtoConfig17 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  21. Make sure the Auto Enrollment for Computer Certificate Policy GPO is under the local domain (or the Server OU).

    012720 1833 HowtoConfig18 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  22. You can force update the GPO to Server via gpudate /force command.

    012720 1833 HowtoConfig19 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

  23. Now, you will see the certificate is showing on the servers and Issued certificates of Certification Authority server.

    012720 1833 HowtoConfig20 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

    012720 1833 HowtoConfig21 - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

Hope you enjoy this post.

Cary Sun

Twitter: @SifuSun

ca16fbd3199de5f66b829b87082fb970?s=80&d=retro&r=g - How to Configure Server Certificate Auto-enrollment #Group Policy #GPO #Certificate #Server #Auto-Enrollment #Mvphour

Author: Cary Sun

Cary Sun is an Principal Consultant, He has a strong background specializing in datacenter and deployment solutions, and has spent over 20 years in the planning, design, and implementation of network technologies and Management and system integration.He hold CISCO CERTIFIED INTERNETWORK EXPERT (CCIE No.4531) from 1997.Cary is also a Microsoft Most Valuable Professional (MVP) and Cisco Champion, He is a published author with serveral titles, include blogs on Checkyourlogs.net, author for many books. Specialties: CCIE /CCNA / MCSE / MCITP / MCTS / MCSA / Solution Expert / CCA
Blog:
http://www.carysun.com http://www.checkyourlogs.net
Twitter:@SifuSun

About Cary Sun

Cary Sun is an Principal Consultant, He has a strong background specializing in datacenter and deployment solutions, and has spent over 20 years in the planning, design, and implementation of network technologies and Management and system integration.He hold CISCO CERTIFIED INTERNETWORK EXPERT (CCIE No.4531) from 1997.Cary is also a Microsoft Most Valuable Professional (MVP) and Cisco Champion, He is a published author with serveral titles, include blogs on Checkyourlogs.net, author for many books. Specialties: CCIE /CCNA / MCSE / MCITP / MCTS / MCSA / Solution Expert / CCA Blog: http://www.carysun.com http://www.checkyourlogs.net Twitter:@SifuSun

Leave a Reply