What's going on, guys? It is Bernardo and today is all about installing enterprise root
certificate authority using Windows Server 2022. So let's get right into it. All right. So this
is a big one because we are actually installing, configuring and creating a GPO for our CA server.
Right. So the first thing that I'm going to do is I'm actually going to
show you that my virtual machine that I'm building everything out is using
Windows Server 2022 is actually version 21h2, right. Build 20348.
First thing I did was I clicked on start I opened up the server manager
within server manager on the upper right hand side. I clicked on manage,
I clicked on add and features. You're going to get the feature wizard.
Click next here, click next here. Click next here. And we need to locate our
Active Directory Service Certificate and we're going to check that off. You're going
to get add features that are required for the Active Directory Certificate Services.
Just click on add feature. Excellent. Click next there. Click next here. Click next here.
And for the roles and services, make sure that certification authority is enabled. Click next
Click Install. It's going to start installing and eventually it's going to give you this.
Once it gives you this, we're going to click on the link that says Configure
Active Directory Certificate Services on the destination server. So click on it.
It's going to prompt you this. So if you want to change the credentials, go for it.
I left everything as is. I clicked on next here. The only role that I selected to configure will
be certification authority. Click next here. I actually left it as a enterprise CA so click
next for the type of CA I want to do a root CA, so click next here for the private key.
I want to create a new one. So click next. I left everything as the default. It's pretty
standard for me within my environment, but you are able to change it. Click next here for the
CA name actually pre populates everything for you, but if you want to change it, go for it.
I click next for the configuration period for your CA by default it's five years. I
bumped it up to ten years. I click next here. This is the default location for
your certificate database. I click next, confirmation of everything that you just did.
Just click on configure. If everything goes well,
you should get a green checkmark with configuration succeeded, click closed,
click close here close this out. We're going to click on the start menu. We're going to open up
your Windows Administrative Tools and we're going to locate your certification authority.
Boom, launches up. So we're just going to open it up. We're going to select
certificate templates. We're going to right click on it and click on Manage and within
Manage. We're going to locate and select the workstation authentication template.
So I'm going to right click on it and I'm going to duplicate the template.
And once I duplicate the template, the first thing I'm going to do is going to general,
I'm going to change the template display name as well as the template name.
Awesome. Next thing that we need to do is go inside the subject name. And for my environment
I'm going to enable the user principal name or the UPN. Then I'm going to go to security. And
within security we're going to click on domain computers and by default already has enroll.
But I want to make sure it has read and also auto enroll. And once you do all that, we're going to
click apply and okay it we're going to close this up. It's going to take us back here and we're
going to right click on the certificate templates and we're going to click on New and we're going
to click on certificate template to issue. And there goes our new template that we just created.
So select it, click okay, and then it gets imported inside the certificate template node,
almost done. So we're going to open up our group policy management and
I'm going to go inside my group policy objects and I'm going to right click
on it and I'm going to go new and I'm going to get my GPO the following name
right certificate enrollment policy pretty standard. And it's going to hit the computer
node and we are going to click, okay, we're going to locate our new GPO.
I'm going to right click on it, click on edit and within edit, we are going to go inside the
following. We're going to go inside computer configuration. We're going to open up policies,
we're going to go inside window settings, we're going to go inside security settings.
We're going to go inside the public key policies. And within there, inside the root of public
key policies. We're going to locate certificate services, client auto enrollment. So we're going
to double click on that. We're going to click on the dropdown menu and then select enable.
Once you click Enable, it gives you the following settings
and I'm going to check off the first two renew expired certificates as well as update
certificates that use certificate templates and then we're going to apply it. Okay it, good.
We're going to locate automatic certificate request settings.
So we're going to select that right click on it. Click on new click on
automatic certificate request it's going to give you this nice little wizard. So
click next here. We're going to click next again and we're going to click on Finish.
We're going to close our GPO and our GPO. We're going to apply it to our Windows
OU. Now, I applied it to my Windows OU because this is where I have all
my workstations and basically you're able to do a update force for your machines to get it.
Now within that OU you I have a V Windows 11 computer object. This is my computer that I have
on that OU. Which is great because hopefully it will get auto enrolled. We're going to go
back inside our CA server and if you go inside our CA server, eventually give it some time.
If you go inside issued certificates, you should see this right, requester name,
which be the computer name. Awesome. And it was applied a certificate. Now if you want
to double check and make sure everything is working correctly, this is one way.
But another way is let's go inside the Windows Server or whatever workstation. If you go inside
the local computer certificate and you go to personal and then go to certificates,
you're going to see those two certificate that
your CA server is providing to your workstation using that group policy.
How awesome is that? And that's it, guys. Hopefully,
guys enjoy this video and I catch you guys on the next one peace out.