Active Directory: Deploying and managing Certificate Service

Promote W25 lead Dc1 to a domain controller and build a complete active directory domain with dns in a Hyper-V lab, using forest functional level 2025 and essence.com zones.

Learn how to join a core server to a domain using PowerShell, verify DNS and network settings, restart, and install DNS service remotely from the domain controller.

Join member servers to the domain and verify DNS settings to enable seamless domain resource access, then enable remote management and install RSAT tools for Active Directory administration.

Install Windows Admin Center on the SVR one member server with express setup and a self-signed certificate. Log in with domain credentials and add DC1 and core1 for centralized management.

Demonstrates creating AD lab users and groups, establishing organizational units, and enabling remote desktop for Windows 11 clients by adding the lab group to Remote Desktop Users.

Configure a dedicated IIS web server for PKI certificate distribution, create and secure the cert enrollment directory, publish CRLs and certificates, and set permissions for the CERT publishers group.

Configure share and NTFS permissions for the certain role folder with modify access for the Publishers group, then create a virtual directory in IIS to expose certificates and CRLs.

Enable directory browsing for PKI troubleshooting and certificate distribution in IIS. Enable delta CRL distribution by configuring double escaping and test with a DNS alias.

Deploys a secure offline root CA as the trust anchor for a PKI hierarchy, with air-gap isolation, security hardening, auditing, and proper authority information access and CRL distribution points.

Define and configure a CA policy file before installing, embedding policy, OID, and notice text; set cert service server parameters, renewal settings, and key usage for server and client authentication.

Install the core certificate services, configure a standalone root CA with a new private key (4096-bit, 256 hash) and 20-year validity, following CDP guidelines avoiding delta CRLs.

optimize root ca settings by removing default CDP entries and configuring two custom CDP entries: a local file system entry for CRL generation and an HTTP distribution entry for offline root CA.

Configure authority information access for the root CA by adding a custom AA entry that directs clients to download the root certificate from the web server for chain building.

Use air-gapped security to move PKI files, bringing an external drive online and copying the root certificate and CRL from the system32 sort SVR folder, then power off.

Deploy an enterprise issuing CA with Active Directory Certificate Services on Windows Server 2025. Create a CA policy INF to enforce 1496-bit renewal keys, ten-year renewals, and zero default templates.

Publish your root CA certificate and CRL to Active Directory, the PKI web server, and the local certificate store to establish a trusted PKI infrastructure for clients.

Install and configure enterprise certificate services, add the Certificate Authority and Web Enrollment roles, enable dependencies, and generate a certificate request for a subordinate CA signed by the root CA.

Transfer certificate requests securely to the offline root ca via removable media in a two-tier pki setup, then sign and retrieve the issued certificate.

Install and activate the enterprise certificate authority, then configure CRL and AIA/CDP extensions to support certificate issuance and chain validation.