And this slip out show how to deploy and configure our 2 2 hour CIA hierarchy.
Demonstration steps.
Here is a scenario for this lab.
Edit them has expanded therefore its security requirements also have increased the security department
is particulary interested in enabling security access to critical websites and in providing additional
security for some features to address these and other security requirements.
A datum has decided to implement a big pay package.
By using the ADC as role in Windows Server 2016 as an administrator at a datum you're responsible for
implementing the ADC as deployment.
So let's start with exercise one where we have to deploy on offline route C..
First we have to create file and print or share an exceptions.
I'll go to see a is we are one as administrator and tech start and then click.
Control Panel in the control panel window.
I'll click view network status and tasks and to the network sharing center window.
I'll click change advanced share and Saddam's other guest or public current profile.
I'll select the tour on file and print or share an option and then click save.
Change it then switch to long as we are 1 and click start and then click.
Control Panel and the control panel window.
I'll click view network status and tasks out the network and share center window.
I'll click change advanced share and sadness and under the main current profile.
I'll select turn on file and print or share an option and then click save changes and switch to task
to where we have to install them configure active directory cert services on Swedish S3 are 1 so I first
will switch to C as we are 1 and click Start and click store manager and server manager I'll click Add
roles and features on the before you begin page click next and on the Select installation type page
click next.
Then on the Select destination server page click Next down to on the Select server rolls page select
active directory cert services while the ad rolls and features resume Vizard window displays click add
features and then click next on the select features page click Next out on the Active Directory cert
services page click next.
Although select roll services page ensure that certification authority is selected and then click next
on the conform installation selection page.
Click install and all the installation progress page after installation complete successfully click
that configure Active Directory cert services on the destination server.
Tax in the ADC has configuration reserved on the credentials page click next and all the roll services
page.
Select certification authority.
Then click next on the set top typed page.
Ensure that stand alone C is selected and then click Next out on the CIA type page.
Ensure that route C is selected and then click next on the private key page.
Ensure that create new private key is selected and then click next on the cryptography for A C page.
Keep the default selections for the selector Cryptographic Provider and select the hash algorithm for
assigning certificates issued by this C but set the key lands to 49 to 6 and then click next on the
CNN page in the common name for this C text box type a data maroon C and then click next and on the
validity period page click next on the C database page click Next down on the confirmation page.
Click configure on the results page click close and all the installation progress page clicked closed
on the C as we are 1 in server manager I'll click tools and then click certification authority and in
the sort as our re certification authority local council I'll right click a data maroon C and then click
properties and turn the ADA to route C proper to a dialog box I'll click the ext step out into select
extensions dropdown list I'll click CRL distribution point or city B and then click Add in the location
textbooks I'll type to to be a call and slash slash long dash as we are wont do it a datum dot com slash
served data and in the wearable dropdown list will click see a name and then click insert and in the
wearable dropdown list or click CRL name suffix and then click and saw and in the wearable dropdown
list I'll click Delta CRL allowed and then click insert then in the location text box position the car
course or at the end of the your rail and I'll type dot CRL and then click Okay.
Select the following options and then click apply.
Include in the city B extension of issued certificates and include in CRL glands.
Use this to find Delta several occasions.
Then in the certification authority pop up window click No.
And in the select extension dropdown list click authority information access or HIPAA and then click
Add in the location text box type H to typical on slash less long dashes were one dot a datum dot com
slash survey data out in the variable dropdown list click server DNS name and then click and saw and
in the location text books type and underscore in the variable dropdown list click see a name and then
click insert positions of course or that of the your real add to the variable dropdown list click certification
name and then click insert location text box position the chorus or that of the your real type a dot
CRT and then click Okay.
Then select the include in the AAA extension of issued certificates checkbox and then click Okay click
yes to restore the certification authorities service learning the certification authority council expand
a datum route see right click revoke certificates point to all tasks and then click publish and the
published zero window click Okay right click a datum rootsy and then click properties enter the atrium
route see properties dialog box click view certificate enter the certificate dialog box click the details
step and then click corporate to file in the certificate X expert will visa turn on the welcome page
click next and on the export file format page select their encoded binary X dot 5 0 9 and then click
next or the 5 file to export page Click browse enter the file name text box type backslash backslash
long dash S3 are one backslash C $ character and then press enter and then the file name text books
type route see click save and then click next click finish and then click Okay three times open file
explorer window and then browse to Windows system so to to sort as a ruby sort and roll folder in the
sort in row folder select both files right click the highlighted files and then click copied in the
file explorer address by bar type backslash backslash long as we are 1 backslash C $ character and then
press enter right click them to space and then click based and closed file explorer then will switch
to task 3 which is created a man named system record for and off line route C so on long this C1 in
server manager I'll click tools and then click DNS and in DNS manager council I'll expand long this
one expand forward look up zone click edit and dot com right click edit am dot com and then click and
you host a record and the new host window in the name text books cell type C dash as 3 are 1 and 2 the
IP address window all type 172 dots extend of zero dot forty in my case and click Add host click OK
and then click down and close DNS manager now we are ready for exercise to where we'll be deploying
an enterprise subordinates see task one for this exercise is to install and configure ADC s on long
as three are 1 along this 1 as we are 1 I'll click stratum click server manager and Lampley add draws
and features I'll click next three times sound select server roll page sails select active directory
cert services then when the a at rolls and features with displays I'll click add features and click
next three times on this electoral services page I am sure the certification authority is selected tolerate
it and then select certification authority web enrollment when the ad rolls and features with displays.
I'll click ad features and then click next on the confirmed installation selection page I'll click install
and all the installation progress page after installation is a successful I'll click configure active
directory cert services on this destination source then I'll click next four times out on the private
key page child ensure that create and use private key is selected and again leak next three times then
on the certificate request page I'll ensure that surface certificate request to file on the target machine
is selected and then click next on the C database page I'll click next and on the confirmation page
I'll click configure and or the results page challenge no.
Ignore the Warren message and click close Tusk to for this exercise where we have to install a subordinate
C certificate so long as we are one I'll open a file explorer and browse to a local disk see right click
rootsy Dodd sir file and then click install certificate and in the certificate import result click local
machine and then click next on the certificate store page I'll click Place all certificates in the following
store and then click browse.
Select trusted root certificate of sources authorities click okay and click next and then click finish
when the certificate import Vizard window appear resale click Okay enter the file explorer window I'll
select the edit on my route see Dot CRL and see a dash as we are 1 underscore datum rootsy see CRT files
right click the files and then click corporate double click on it play out pop and double click dub
dub dub en route then click a new folder and then name it sort data based layer to corporate files into
that folder then I'll switch to local disk C and track all right click long as we are one dot a datum
dot com underscore a datum that this long dashes we are one dash C dot req file and then click corporate
enter in the file explorer address borrowed time backslash backslash seed Dash is free one does see
a dollar character and then press enter and in the file explorer window or right click on them to space
and then click paste make sure that the request file corpus to this folder switch to the C as C is as
we are one of sort or enter the certificate authority console out right click a data Maruti C point
all task and then click click submit your request then I'll open a request file window navigate to local
C drive click the launch sphere one dot Iraq file and then click open the certification sorry to console
I'll click the band and request container and right click band and request and then click refresh and
the details Spain L right click the request with idea to point to all tasks and then click issue and
enter the certification authority console I'll click the issue certificates container in the details
pay and I'll double click left certificate click the details tab and then click copied to file in the
certificate export visa to the welcome page I'll click Next down on the expert file format page I'll
look cryptographic message syntax standard or dot P 7 B file click include all certificates of the certification
pass if possible and then click next on their filed two x per page show click browse enter the file
name text books all type sub C click save click next click finish and then click Okay twice.
And switch to lawn as we are one fountain server manager or click tools and then click certification
authority and the certification authority.
Council right click item issue and see point to all tasks and then click install says certificate.
Go to a local C drive click the sub see a dot P so and B file and then click open.
I'll wait for 15 20 minutes seconds and then all the toolbar click the green icon to start.
This is Soros and ensure that this is successful this starts and switch to a smaller one.
Shut down the server and finally task three where we have to publish a root C certificate through a
group policy.
So on long DC 1 and server manager I'll click tools and then click group policy management in group
policy management council I'll expand for us expand demands expand a datum dot com right click default
demand bolus and then click added and in the computer configuration note I'll expand policies expand
vendors sentence security to certain public policies and the right click trusted route certification
authorities and click import and then click next on the file to import page shall click browse sound
to the file name text I'll type backslash backslash long dashes where one backslash C $ character and
then press enter click their route C dot sir then click open then I'll click next two times and then
click finish when the certificate import reserved window appear so click okay it might take 15 to 20
seconds for this window to appear at last that will finish the demonstration steps for this slap where
we've successfully deployed and configured to to see a hierarchy.