Active Directory Certificate Services Cross-Forest Enrollment

Consolidating certificate templates from multiple forests

Download 312 Kb.

Page	6/15
Date	04.02.2024
Size	312 Kb.
	#63423

1 2 3 4 5 6 7 8 9 ... 15

ADCS Cross Forest Enrollment

Copying account forest certificate templates into the resource forest

Consolidating certificate templates from multiple forests

Because AD CS deployments can vary greatly, the exact steps you must take to consolidate your existing certificate templates cannot be described in this guide.
The goal is to reduce the number of CAs and certificate templates in a multiforest environment by creating a set of certificate templates issued by resource forest CAs that provide certificates to domain members in all forests.
Based on the number of forests and certificate templates in your environment, the timeframe you have to complete AD CS consolidation, and the requirements of your organization, you can use a combination of procedures described in this section to define the set of certificate templates issued by your resource forest CAs.
For each certificate template you plan to issue from the resource forest, consider which of the following methods best meets the goals and requirements of your organization and complete the procedures described in that section.
 Copying account forest certificate templates into the resource forest
 Consolidating certificate templates with similar purposes from multiple account forests
 Consolidating version 2 and version 3 default certificate templates
 Consolidating version 1 default certificate templates
The procedures described in this section require the Windows Powershell script PKISync.ps1. Complete the procedure To Save PKISync.ps1 to a file.

Copying account forest certificate templates into the resource forest

The simplest way to consolidate AD CS from multiple forests into a single resource forest is to copy the certificate templates from all account forests into the resource forest and configure AD CS to issue certificates from the resource forest. Because all certificate templates remain available, the rate of certificate enrollment remains steady and there is no impact to users.
This method reduces the number of CAs in the enterprise but the resource forest might have multiple certificate templates for some types of certificates; for example, if certificate templates for S/MIME certificates are copied from multiple account forests into the resource forest.
Complete the procedures from a domain member computer that has access to the resource and account forests. Log on using an account with permissions to update AD objects in resource and account forests. Members of Domain Admins and Enterprise Admins group have the required permissions.
The procedure must be completed for each certificate template you want to copy into the resource forest. You cannot copy multiple certificate templates simultaneously.

To copy certificate templates from an account forest to the resource forest

1. Start Windows Powershell. Change the current directory to the location of the PKISync.ps1 script.
2. Copy the certificate template from the account forest by using the command .\PKISync.ps1 -sourceforest -targetforest -type Template -cn .
Note
If a certificate template in the resource forest has the same name as the certificate template you want to copy from the account forest, you must rename the certificate template in the account forest before copying the template to the resource forest. See Rename a Certificate Template.
3. Copy the OID container from the account forest by using the command .\PKISync.ps1 -sourceforest -targetforest -type Oid –f and press ENTER.
4. Grant administrators permissions on the certificate template in the resource forest. Grant Full control to Enterprise admins group, which is the equivalent of default certificate template permissions. Alternatively, you can define custom permissions according to your organization’s security policy. See the Security Tab section of Extensions Tab.
5. Grant domain members permissions on the certificate template in the resource forest. Grant Read, Enroll, and Autoenroll permissions to the intended users. The access control list defined on the certificate template in the account forest is preserved during the copy operation, but you should verify permissions are correct and grant permissions to additional users in other account forests as needed. See the Security Tab section of Administering Certificate Templates.
6. Publish the root CA certificate from the account forest to the resource forest by using Certutil.exe at a command prompt to run the following commands:
a. certutil -config \ -ca.cert
If you are logged on to the CA you can omit the connection information, -config \ to connect to the local CA.
b. certutil -dspublish -f RootCA
7. Publish enterprise CA certificates from the account forest into the NTAuthCertificates and AIA containers in the resource forest.
a. certutil -config \ -ca.cert
b. certutil -dspublish -f NTAuthCA
c. certutil -dspublish -f SubCA
Note
Steps 6 and 7 are required because renewal requests can be signed by certificates issued by CAs in the account forests. The CA certificates from the account forests are required for issued certificates from account forests to be valid in the resource forest.
8. Assign the certificate template to an enterprise CA in the resource forest. See Add a Certificate Template to a Certification Authority.
9. Copy the assigned enterprise CA object from the resource forest by using the command .\PKISync.ps1 -sourceforest -targetforest -type CA -cn –f. To determine the CA sanitized name, log on to the CA, start a command prompt, type Certutil.exe and press ENTER. The sanitized name is displayed in the command output.
10. Copy the certificate template object from the resource forest by using the command .\PKISync.ps1 -sourceforest -targetforest -type Template -cn –f.
11. Remove the old certificate template from enterprise CAs in the account forest by using the Certification Authority snap-in. Click Certificate Templates, right-click the old certificate template, and click Delete.

Download 312 Kb.

Share with your friends:

1 2 3 4 5 6 7 8 9 ... 15