Solved

PKI Template has been configured but not being deployed ?

Posted on 2015-01-30
1
140 Views
Last Modified: 2015-02-12
Hi Everyone,

I have deployed a 3-tier PKI infrastructure in a Windows 2008 R2 envinronment.  There is a GPO in place for auto-enrollement of certigicates via a GPO.  Attached to the GPO is a security filter which has a group that only contains computer objects to deploy certificates to. I have copied the Computer template, duplicated and called 'Test AE'.  When I open the certificate on the test server, the 'Geneeral' tab displays the purpose of the certificate as 'All applications policies'.  If I click on the 'Details' tab and scroll down, where it details 'Certificate Template Name' the value is SubCA.  I expect the 'Certificate Template Name' to be 'Test AE' ?  

In the AD CS management console under 'Certificate Templatres' it does have the 'Test AE' displayed.  Also, the template on the security setting has the group I associated in AD to the GPO.  I have the group with 'Read','Enroll' and 'Autoenroll' configured.

Does anyone have any ideas as to why this is happening ?
0
Comment
Question by:CaussyR
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
1 Comment
 
LVL 37

Accepted Solution

by:
Mahesh earned 500 total points
ID: 40579600
The certificate you seen is from subordinate CA and I don't think it is got deployed through GPO
Delete that cert from test server and run gpupdate /force again to see what certificate is getting installed

do not duplicate computer certificate, it is default certificate template
U can directly use it via GPO, in GPO, under "computer configuration\policies\windows settings\security settings\ public key policies" enable certificate enrollment and auto enrollment
Then navigate to automatic certificate request settings and add "computer" certificate template there which will take care of auto enrollment
https://technet.microsoft.com/en-us/library/dd379529(v=ws.10).aspx

If you wanted just client authentication, do above auto enrollment settings in policy and duplicate workstation authentication certificate and check if it works
Because computer template contains both server authentication and client authentication
0

Featured Post

Ransomware: The New Cyber Threat & How to Stop It

This infographic explains ransomware, type of malware that blocks access to your files or your systems and holds them hostage until a ransom is paid. It also examines the different types of ransomware and explains what you can do to thwart this sinister online threat.  

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article summaries thoughts and ideas from two years of sustained use. It provides good reasoning to make the jump to Windows 10.
Configuring Remote Assistance for use with SCCM
The viewer will learn how to successfully create a multiboot device using the SARDU utility on Windows 7. Start the SARDU utility: Change the image directory to wherever you store your ISOs, this will prevent you from having 2 copies of an ISO wit…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…

739 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question