Certificate templates define how a certificate is requested and used such as for file encryption or
email sign it.
You configure templates on the CIA and the Active Directory Domain Services database stores them.
There are several different versions of templates that correlate to their breeding system one they see
a vendor a Server 2016 supports Version 4 templates and earlier template versions.
The two types of certificate categories are certificate templates for users and certificate templates
for computers you can use both the user and computer.
Template 2 for multiple purpose you can assign permissions to certificate templates to define who can
manage them and can perform enrollment or auto enrolment.
You also can update certificate templates by modifying their original certificate template coping template
or superseding existing certificate templates.
And this section you'll learn how to manage and deploy certificate templates.
Now after completing this section you'll be able to describe certificates and certificate templates
describe certificate template versions and Windows Server 2016.
Describe how to configure certificate template permissions.
Describe how to configure certificate template settings.
Describe options for updating a certificate template.
And you'll be able to modify and enable a certificate template but before we start this section as usual
let's answer some reassessment questions to find out whether you should learn whether you should proceed
with this information.
So question 1 which of the following statements are true regarding Version 2 certificate templates in
a DCF.
Option 1 version 2 templates support auto enrolment Option 2 You can only modify the security tap on
a version to template options 3 you can upgrade to a version 2 template by duplicate and a version one
template option for only Windows Server 2008.
Windows Vista and later operating systems support Version 2 templates and 2 option 5 only Windows Server
2012.
Windows 8 and later operating systems support 2 Version 2 templates rest pause here and so on.
Think about the correct answer and the answer is Option 1 and option 3.
One important aspect of Version 2 templates is that they support auto enrolment by Active Directory
Domain Services Users and Computers.
Unlike version 1 templates you can modify all aspects of a version to template to a greater version
to a template you can duplicate version one template Version 2 templates are supported on Windows Server
2003 Enterprise Edition.
Windows Server 2008 enterprise and Windows Server 2008 are two and later now the second question.
You are the ADC yes administrator for a datum Corporation.
Several users in your D s and Wirawan have auto enrolled to user a certificate.
You want to shorten the related to period of user certificate and need to ensure that users get a new
certificate immediately as our experience in any break in validity of the existence certificate ritual
the folder and actions should you take option one duplicate the existing template and provide a new
template name modify their validity period of the new template option to modify their validity period
of the existing template.
Option 3 modify the auto enrolment settings of the existing template option for revoke all user certificates
issued from the existing template and the final option modify their new template so that it supersedes
the existing template and publish the new template.
Stop here and think about the answers and the answer is option 1 option 4 and Option 5.
In this situation you should duplicate the existing template providing a new template name and validity
period.
In addition you should update the new template so that it supersedes the previous template.
After you publish the new template turn enterprise C users who had auto enrolled against the previous
template will auto enroll again for the new template once new certificates with the correct validity
period have replaced the previously issued certificates.
You should revoke all user a certificate from the existing template so that users can not use them.
If you modify their validity period of the existing template new auto enrolment against the template
will have the correct sentence but previously issued certificates will still contain the undesired validity
period.
Modify the auto enrolment sentence on the existing template is not necessary and would not achieve the
desired effect.
No next stop will be talking about what are of certificates and certificates certificate templates.
I'll see you there.