In this loop, we'll see how to deploy and use certificates.
As you remember, scenario for this SLAPP is that you are working as an administrator at a datum corporation.
As a datum expands, its security requirements are also increasing.
The security department particular is interested in enabling secure access to critical websites and
in providing additional security for features such as air fares, digital signatures, smart cards and
the direct access feature in Windows ten.
The security department especially wants to evaluate digital signatures in Microsoft Office documents
to address this and other security requirements.
It has decided to use certificates issued by the ADC as rule in Windows Server 2016.
As an administrator at a datum you are responsible for implementing certificate enrollment.
You also will be deploying the procedures and processes for managing certificate templates and for deploying
and rewarding certificates.
So let's start with exercise one.
Where will configure certificate templates?
In Task one will create a new template based on the web server template.
I'll go to a longer one and server manager.
I'll click tools and then I'll click Certification Authority and in Certification Authority Console,
I'll expand it to them.
See and right click certificate template.
And then select, manage and the certificate templates console.
I will look into the web server template in the list and right click it and then click duplicate template,
click the general type in the template, display name tags, books and type production, web server
and then type three in the validity period textbooks.
Click the request handling tab select allow private key to be exported and then click okay.
Minimize the certificate templates in the Certification Authority console on well on this one, right
click revoke certificates select.
All tasks.
Click, publish and then click.
Okay.
In Task two will create a new template for users that includes smart cards.
Sign in of one, two, three, one and Server Manager Click Tools and then Click Certification Authority,
expand to date and see right click certificate templates and then click manage and the Certificate Templates
console.
Right click the user certificate template and then click duplicate template in the properties of new
template dialog box.
Click the general tab element in the template display name textbooks, type a date and user.
All this subject name to clear both the include email name and in subject name and email name check
books of all the extension step click application policies, then click added in the added application
policies extension dialog box, click add and in the Add Application Policy Dialog Box, select, smart,
colorful and role and then click okay twice.
Click the superseded template, step, click and collect the user template and then click okay all the
security tap click authenticated users and under permissions for authenticated users.
Select the allow checkboxes for root and roll and or turn roll and then click.
Okay.
Close the certificate templates.
Cancel.
Now Task three, where we have to configure templates so that they can be issued all on display.
One in the Certification Authority console, right click certificate templates point to new and then
click certificate template to issue and the Enable Certificate Templates window.
Hold the control key and click both a datum user and production web server.
Then click okay.
And finally, the task force where we have to enroll the web server certificate on long as we are to
I will switch to along as you are to click start and then click the Windows PowerShell as a common prompt
of Windows PowerShell.
I'll type update, slash force and then press enter.
Good start and then click server manager from Server Manager Click Tools and then click Internet Information
Services Manager or yes manager in the areas console click long as we are to and then in the center
open double click server certificates in the actions plan click create the main certificate and on the
distinguished name properties page, complete the full on filter, then click next out common name which
as long as we are to download it to the gloom organization 8:08 a.m. Organizational Unit t city, state,
country and region which of the US?
All the online certification authority page.
Click Select.
Click Add item and then click okay in the friendly name text box type.
As we are two of them click finish.
Ensure that the certificate displays in the server certificates console in the I as console.
Expound long duchess.
We are to expand sites and then click default website and the action spend click by emergence and to
the side bindings window select and.
In the outside by the window select a stitch appears from the type dropdown list in the SSL certificate
dropdown list.
Click along the shows we are to click okay and then click close closed Internet Information Services
Manager and three Stolen Client one do the search field type Internet Explorer Click Internet Explorer
in the search results returned and in Internet Explorer type HTP URLs colons won't disappear as we are
2.2.1. com in the address bar and then press enter ensure that the Internet Information Services page
opens and that no certificate error displays.
Now let's switch over to Exercise two, where we'll be enrolling on to your certificates.
In Task one, we'll be configuring auto enrolment for user so on on this one and server manager click
tools and then click group policy management.
Expand Forest Area on dot com expense domains.
88. com right click default domain policy.
And then click added expand user configuration Expand Policies Window Settings, Security Settings Alarm
Click to highlight public key policies in the details pane double click certificate services, client
auto enrolment and to the configuration model dropdown list Click Enabled Select Renew Expired Certificates,
Update Pending Certificates and remove recall Remove certificates and update certificates that use certificate
templates.
Then click okay to close a purchase window in the right pane, double click the certificate services,
client certificate, enrolment policy object and all the enrolment policy step third to the configuration
model to enabled and then ensure the certificate enrolment policy list displays the Active Directory
enrolment policy.
It should have a checkmark next to it and display a status of enabled.
Click okay to close the window.
Close both to the group policy management editor window and the group policy management console.
No.
Let's switch over to task two where we have to verify auto enrolment on implant one, click start type
PowerShell and then click PowerShell icon.
The Windows PowerShell command prompt old time GP update slash false and then press enter after the
policy refreshes type MCU dot C and then press enter in console one click file and click add remove
snapping click certificates, click add, click finish and then click okay expense certificates current
user expense personal and then click certificates.
Verify that a certificate based on the eight item user template is issued to administrator to verify
the name of the template, scroll to the right in the console window and then close console while reload
saving changes then staying out of clone long client one.
Just three where we have to configure the enrollment agent for smart card certificates.
So on launch this one and server manager click tools and then click open.
Certification Authority mountains are served as a service console.
Still expect a datum CAA right click certificate templates and then click manage and the certificate
templates console double click and enrollment agent and click the security tab and then click add in
the select users computer service accounts or groups window type and it.
Click chick names and then click okay.
On the security tab, click any corner, select the allow checkbox for redirect control permission and
then click.
Okay.
Close the certificate templates console in the search survey console, right click certificate templates
point new and then click certificate template issue.
In the list of templates, click enrollment agent and then click okay.
Now a switch to a long client one and sign in as a datum and a user visit with your password.
Click Start Command Prompt and then press press enter as a common prompt window time M.C. Adult Excel
then pro center and console one click file click add and remove snipping click certificate alarm click
add and then click okay expense certificates Current User Expense Personal Click Certificates and Right
Click Certificates.
Parent to all tasks and then click request new certificate and to the certificate certificate enrollment
resort all the before you begin page, click next on the Select Certificate Enrollment Policy Page.
Click next out of the request certificates page.
Select Enrollment Agent, Click Enroll and then click finish sign out of long client one and switch
to want to see what the Certification Authority Council, right click agency and then click properties
until the enrollment agent step click or restrict enrollment agent.
And on the popup window that displays click on it in the enrollment agent section.
Click and enter in the select user computer or group field type and then click jerk names and then click
okay.
Click everyone and then click remove in the certificate template section and click add ads in the list
of templates, select a date of user and then click okay.
In the certificate templates section, click all and then click remove and to the permission section,
click add.
You know, select to use a computer or group filled type market and click check names and then click
okay and turn the permission search and click everyone.
Click remove and then click.
Okay.
So we are going to task for where we use certificates for digital sign in over Microsoft Office document.
So first all one platform will sign in as a data administrator as his password and click the start button
type word and then click words icon.
If you receive a prompt for Microsoft Office activation rather than click close.
Good blend, document some text and then save the document to the desktop.
On the toolbar, click insert and then in the taxpayer spanning the signature line dropdown list, click
Microsoft Office Signature Line and turn the signature at the top window.
Type your name in the suggested sign or text books.
Type administrator in the suggested signers title text book.
Send the administrator at any datum dot com.
For your email.
Then sign in the sign window, click change and through the windows security window under a select certificate,
select the administrator certificate with today's date and then click okay and turn the text box to
the right of the X.
Type your name.
Click sign and then click.
Okay.
Instead of type in your name, you can also select an image.
This image can be your scanned handwriting signature.
Now ensure that you can not enter the document further.
Try to try to type some text on the document that includes Microsoft Word, then save changes if you
receive a prompt sign out of long client one.
And we are coming to exercise three where we'll be configuring and implementing query color.
So Task one for this exercise is to configure the certification authority to issue key arrays certificates.
First on launch is the one and the Certification Authority Council will expand the eight agency node.
Click right, click the certificates templates folder and then click manage.
And when the details spin, right click the key recovery agent certificate and then click properties.
And two of the key recovery agent properties dialog box click the issuance the recovery.
A requirement step, then clear the see a certificate manager approval check books, then click the
security step.
No, just the domain admin center enterprise segments are the one the groups that have the enroll permission
and then click okay close the certificate templates console until the certification authority console,
right click certificate templates and point new and then click certificate template issue and to enable
certificate templates, dialog books, click the key recovery agent template and click.
Okay, close the Certification Authority Council.
Now let's switch to task two, where we'll be acquiring the query certificate.
So all on this one will click start and then click the Windows PowerShell at the Windows PowerShell
Command prompt type C for a center around to the console one console, click file and then click add
remove snap ins.
Add to the add or remove snipping dialog box, click certificates and then click add.
In the certificate certificate snap in dialog box.
Select my user account and click finish and click.
Okay.
Then expand the certificates current user note right click personal form to all tasks and then click
request new certificate.
Enter the certificate enrollment result all the before you begin page click next.
And on the Select Certificate Enrollment Policy page.
Click next on the request certificates page.
Select the key recovery agent, check books and click Enroll and then click Finish.
Refresh the console and then view the key recovery agent in the personal store.
Scroll across the certificate properties and verify that certificate template key recovery agent is
present then close console one result your saving change of.
Just three here.
We have to configure the CAA to allow Kir recovery.
So on one DC, one in server manager Click Tools and then click certification authority and turn the
Certification Authority Console, right click add agency and then click properties and turn the agency
properties dialog box.
Click the Recovery Engine Step and then select archive the key.
Under key recovery agents certificates and until the key recovery agent selection dialog books click
more choices and click the certificate with the K I.R.A. Purpose, it most likely will be lost on the
list issued to administrator.
And then click okay twice when prompted to restore the certification authority.
Click.
Yes.
So we are at task four where we have to configure a custom template for key archival.
So on this one, the Certification Authority Council expand datum and right click certificates templates
folder and then click manage in the certificate template console, right click the user certificate
and then click duplicate template.
In the properties of new template darling marks on the general tab and the template display name tags
box type archive user account on the request handling tab.
Select the archive subjects and groups and private key books.
If a pop up window displays, click okay.
Click the select name to clear the email name and include email name and subject name checkboxes.
And then click.
Okay.
Close the certificate templates console down to the Certification Authority console right.
Click the certificates templates folder, point to new and then click certificate template to issue.
In the Enable Certificate Templars dialog box, click the archive user template and then click.
Okay, close the Certification Authority Council.
And finally, task five.
Well, we have to verify.
Key archival functionality, we'll have to assign them to one client.
One is a datum aiding with his pass for account on the star screen type MCU, dot XY and then recenter
if prompted click yes in the user account control window in the console one console click file and then
click add or remove snap in.
Add on to that add or remove snap in the dialog box.
Click Certificates.
Click Add and then click.
Okay.
Expand the certificates.
Current User Note.
Right Click Personal.
Right click all tasks.
And then click request.
New Certificate.
Add to the certificate enrollment result before you page.
Click next and the Select Certificate Enrollment Policy Page.
Click next.
And from the request certificates page, select the archive user checkbox.
Click and roll and click finish.
Refresh the console, then expand personnel and click certificates.
Note that a certificate is issued to aid and based on the archive or a certificate template.
Simulate the loss of the private key by deleting the certificate.
Enter the central bin.
Right.
Click the certificate that you just unroll.
Select delete and then click.
Yes to confirm.
No switch to long to see one.
Open the Certification Authority console, expand ad agency and then click the issued certificate store
and to the details pane double click a certificate with a requester name of Adam, Adam, Adam and a
certificate template name of the archive user.
Click the details step Corbett Serial number, then click.
Okay.
You might copy the number either by selecting it and press and control C or by noting it in a document.
Then click the start button and then click the Windows PowerShell icon and the Windows PowerShell Command
prompt type the following command.
Well, a serial number is a serial number is too corporate, so you'll have to type two till does get
key serial number output block.
If you copy and paste the serial number, remove the spaces between the numbers or and close the serial
number between double quotes.
So next verify the output below file.
Now displays c c users administrator folder.
And to convert the output block file into a dot perfects file at the Windows PowerShell command prompt
type the following command and press enter you have to type cert util dash recovery key output below
eight dot perfects when prompted for the new password type the password and then confirm the password.
Then after the command to execute close Windows PowerShell, go to a C drive, use our administrator
and then verify that Aidan dot B effects, which is the recovery key is created.
After the switch to a long client, one open file explorer and then browse to back slow but sluggish
long does this 1.8. com backslash.
See below to sign when prompted for credentials.
Use a from administrator with his password, then go to a backslash backslash.
All this one they did not come backslash c door sign backslash users backslash administrator and right
click the agent dot facts file and then select copy go to see drive users say them and to the empty
space right click on them.
Select paste.
Double click the Aidan Dot Fairfax file.
Angela.
Welcome to the certificate import freezer page.
Click next on the file to import page.
Click next out of the password page.
Type the password and then click next on the certificate store page.
Click next, click finish and then click okay.
And from the console one.
Expand the certificates current user note, expand personal and then click certificates.
Then refresh the console and then verify that the certificate for Radiant is the restore.
This will finish the lab where we deployed two used certificates.