Configuring certificate approval on a Windows internal CA

Posted on 2011-10-29
Last Modified: 2012-08-13
I have an enterprise CA installed in my Windows organization but for some reason users are able to request User Certificates and automatically install the certificate without an administrator first approving the request. How can I configure the existing User Certificate or all requested certificates by end users to fall in the pending folder so that an administrator first review the request and then issue the certificate if the request is valid?

Thank you,
Question by:serg2626
    LVL 17

    Accepted Solution

    By default, users and computers can request certificates, and they will be automatically approved.  To change this behavior, you are going to have to modify the template.  In reality however, one does not modify a template, but creates a new one based on the original template.

    Open up Certification Authority MMC on your CA
    Go to Certificate Templates
    Right click Certificate Templates, and then select "Manage"
    Find the base template (for example User or Computer), right click and select "Duplicate Template".
    When prompted for Windows Server 2003 Enterprise or Windows Server 2008 Enterprise, choose the default (2003 Enterprise).  This is just for backwards compatibility.
    Give your new template a unique display name and name
    Make your necessary changes, changing "Issuance Requirements" to require CA certificate manager approval (see image)
    CA certificate manager approval
    Once you've created your new templates, deactivate your old ones, and then add the new ones.  Do this by:

    Close your Certificate Templates Console
    Go back to the Certification Authority MMC
    Go to Certificate Templates
    Right click Computer -> Delete (assuming you are replacing this template)
    Right click User -> Delete (assuming you are replacing this template)
    Right click Certificate Templates, select New and Certificate Template to Issue.  Here you can add the new templates you've created.

    NOTE: Deleting templates from "Certificate Templates" only deletes the templates from the available templates of the Certificate Authority.  It does not delete them permanently.  You can always re-add the original User and Computer certificate templates if you wish.

    Author Comment

    Excellent! It worked. Thank you for the clear instructions!
    LVL 17

    Expert Comment

    Glad to have been of assistance.  I find clear, concise instructions very helpful, which is why I try to do it for others :)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Wish Marketing would stop bothering you?

    Is your marketing department constantly asking for new email signature updates? Are they requesting a different design for every department? Do they need yet another banner added? Don’t let it get you down! There is an easy way to manage all of these requests...

    Suggested Solutions

    Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
    Container Orchestration platforms empower organizations to scale their apps at an exceptional rate. This is the reason numerous innovation-driven companies are moving apps to an appropriated datacenter wide platform that empowers them to scale at a …
    This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
    This tutorial will walk an individual through the process of upgrading their existing Backup Exec 2012 to 2014. Either install the CD\DVD into the drive and let it auto-start, or browse to the drive and double-click the Browser file: Select the ap…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now