Active Directory: Deploying and managing Certificate Service

Promote W25 lead Dc1 to a domain controller and build a complete active directory domain with dns in a Hyper-V lab, using forest functional level 2025 and essence.com zones.

Learn how to integrate a Windows Server Core into an Active Directory domain using PowerShell, validate DNS, enable remote management, and install DNS remotely.

Join member servers to the domain and verify DNS settings to enable seamless domain resource access, then enable remote management and install RSAT tools for Active Directory administration.

Install Windows Admin Center on the SVR one member server with express setup and a self-signed certificate. Log in with domain credentials and add DC1 and core1 for centralized management.

Demonstrates creating AD lab users and groups, establishing organizational units, and enabling remote desktop for Windows 11 clients by adding the lab group to Remote Desktop Users.

Configure a dedicated IIS web server for PKI certificate distribution, create and secure the cert enrollment directory, publish CRLs and certificates, and set permissions for the CERT publishers group.

Configure share and NTFS permissions for the certain role folder with modify access for the Publishers group, then create a virtual directory in IIS to expose certificates and CRLs.

Enable directory browsing to support troubleshooting and manual retrieval of certificates and CRLs. Enable double escaping for delta CRLs in IAS to allow plus-sign file names for efficient validation.

Deploys a secure offline root CA as the trust anchor for a PKI hierarchy, with air-gap isolation, security hardening, auditing, and proper authority information access and CRL distribution points.

Create and configure the ca-policy.inf file on the root CA to define security and policy settings, certificate extensions, and parameters such as 4096-bit keys and 20-year validity.

Install the core certificate services, configure a standalone root CA with a new private key (4096-bit, 256 hash) and 20-year validity, following CDP guidelines avoiding delta CRLs.

optimize root ca settings by removing default CDP entries and configuring two custom CDP entries: a local file system entry for CRL generation and an HTTP distribution entry for offline root CA.

Configure authority information access for the root CA by adding a custom AA entry that directs clients to download the root certificate from the web server for chain building.

Use air-gapped security to move PKI files, bringing an external drive online and copying the root certificate and CRL from the system32 sort SVR folder, then power off.

Deploy an enterprise issuing CA with Active Directory Certificate Services on Windows Server 2025. Create a CA policy INF to enforce 1496-bit renewal keys, ten-year renewals, and zero default templates.

Publish the root CA certificate and CRL to Active Directory, the PKI web server, and local stores to establish trusted distribution points for domain-joined and non-domain devices.

Install and configure enterprise certificate services, add the Certificate Authority and Web Enrollment roles, enable dependencies, and generate a certificate request for a subordinate CA signed by the root CA.

Transfer certificate requests securely to the offline root ca via removable media in a two-tier pki setup, then sign and retrieve the issued certificate.

Install and activate the enterprise certificate authority, then configure CRL and AIA/CDP extensions to support certificate issuance and chain validation.