On a Windows server 2016, see, you can configure certificate enrollment so that designated users can
enroll on behalf of other users in your organization.
A designated user is referred to as an enrollment agent, which is a user account used to request certificates
on behalf of another user account to enable enrollment on behalf of another user.
The enrollment agent must process.
The certificate, based on the enrollment agent template, unlike a certificate manager and enrollment
agent, can only process the enrollment request and cannot approve pandan request or revoke issued certificates.
Please know that since a user who possesses an enrollment agent certificate.
Can impersonate other users.
You can secure the enrollment agent template appropriately.
As a best practice, it is recommended that you publish the enrollment agent template only on a C whenever
it is necessary to designate an enrollment agent to your organization after the enrollment agent has
received the necessary certificate.
You should remove the enrollment agent and bleed from any is where it was published.
Windows Server 2016 includes three Cert templates that enable different types of enrollment agents.
Enrollment agent.
Already mentioned youth to request certificates on behalf of another subject.
Enrollment agent computer, which is used to request certificates on behalf of another computer subject
and exchange enrollment agent or will fly and request.
It was used to request certificates on behalf of another subject and supply the subject name in the
request.
The networking device enrollment service uses this template to for its enrollment agent certificate.
Typically, you would designate one or more authorized individuals with an organization as enrollment
agent, enrollment agents typically or members of corporate security.
I do security or helpdesk teams because these individuals are already trusted to safeguard valuable
resources.
In some organizations, such as banks that have many branches, help desk and security workers might
not be in a convenient location for performing this task.
This is a case you might need to designate a branch manager or another trusted employee other than enrollment
agent to enable the issuance of smartcard credentials in multiple locations.
When you create an enrollment agent, you can restrict the agent's ability to enroll for certificates
on behalf of all the providers by limiting their scope to a specific security group and specific certificate
templates.
For example, you might want to restrict the enrollment agent to perform an Smartcard Logan certificate
enrollment for only users belonging to a specific department security group.
Prior to Windows Server 2008 Enterprise, it was not possible to restrict the scope of a do sales enrollment
agent.
As a result, every user is an enrollment Agent Cert was able to enroll any user in an organization
for any certificate template.
However, with more recent versions of it, it says you can limit the scope of the enrollment agent
to specific groups and certificate templates for each certificate template.
You can select the users or security groups on behalf of reach and enrollment.
Agents can enroll.
Please know that you cannot restrict an unromantic agent based on specific a religious or organizational
units or containers.
You can restrict enrollment agents on behalf of other users only to specific users or security groups.
And it is.
Restricting the scope of enrollment, agent can affect the performance of the CAA to optimize performance
and security.
You should minimize the number of accounts designated as enrollment agents by modifying the access control
list on the enrollment agents template.