And this led bill, but deploying them to using certificates.
Here is the scenario for this lab.
You are working as an administrator and a datum corporation as it expands, its security requirements
are also increasing.
The security department particular is interested in enabling secure access to critical websites and
in providing additional security for features such as IFRS, digital signatures, smart cards and direct
access.
Feature in.
I mean those.
8.1 and Windows ten.
The security department especially wants to evaluate digital signatures in Microsoft Office documents
to address these and other security requirements.
14 8:08 a.m. has decided to use certificates issued by the ADC after all in Windows Server 2006 to.
As a senior network administrator at any time, you are responsible for implementing certificate enrollment.
You also will be developing the procedures and process for managing certificate templates and for deployment
revoking certificates.
Now after you complete the slab, you'll, you'll have configure certificate templates, configure certificate
enrollment and usage and configured and implemented key recovery.
There are three exercises for this level.
Let's start with exercise one.
Scenario after deployment, the sea infrastructure.
The next step is to deploy the certificate templates that the organization requires.
First aid team wants to implement a new Web server certificate and certificates for users.
The main tasks for this exercise are as follows.
First, you have to create a new template based on the web server template.
Second, create a new template for users that includes smart cards.
And then third, configure templates so that they can be issued.
And lastly, enroll the web server certificate on long as we are to.
Let's review the steps for Task One, in which you have to create a new template based on the web server
template on this one, and server manager will have to click tools and then click certification authority.
And to the Certification Authority Council, you have to open certificate templates, console, duplicate
the web server template and create a new template that and then name it production web server, configure
validity for three years and configure the private key x as exportable and publish the CRL on londis
c one.
No talk to their.
Eight steps to complete this task in which you have to create a new template for users that includes
Smartcard Sign.
So step one on land is the one you have to open certification authority console from server manager
and then open the certificate templates council and then duplicate the user a certificate template name
the new template added to the user and on the subject name tap clear both the include email name and
subject name and the email name checkboxes then add Smartcard Lagoon to the application policies or
the new certificate template and configure this new template to supersede the user template.
The second step is to allow authenticated users to read and enrollment or to enrol for the certificate.
And finally close to the certificate templates, council tasks three in which you have to configure
templates so that they can be issued.
So issued the certificates based on the date and user and production web server templates.
Just four in which you have to enroll the web server certificate on long as we are to.
Here are the steps for this task.
First switch to as long as we are to clean your lab environment.
Open Windows PowerShell and then refresh group policy on server manager.
You have to open Internet information services.
I as manager and learn and rule for a domain certificate by using the following settings.
Common Name Loss Learn as we are to edit dotcom organization edit term organization to unit i.t suited
Seattle State.
W a gone to us friendly name alone as we are to.
The fifth step for this task is to you have to create an eclipse binding for the default website and
then associated with the loan as well to a certificate.
And finally open internet explorer on loan client one and then navigate to institute is.
Girl and slash slash low dash as well.
2.8.1. com And to ensure the Internet Information Services page opens and that no certificate error
displays.
So after completing this exercise you should you should have configured certificate templates.
Wonder how Donna is exercise one.
Let's be sure to exercise two, which is in running and using certificates.
The scenario for this exercise the next step in implementing a big at eight two is configured certificate
enrollment a date and wants to enable different options for distributing the certificates.
Users should be able to enroll automatically, and card users should get their smart cards from enrollment
agent.
Aid agent has delegated enrollment agent right.
For the marketing department group to.
User, Annie Connor.
The main tasks for this exercise are as follows You have to configure auto enrolment for users, then
verify auto enrolment.
The third task is configure the enrollment agent for smart certificates and finally the user certificates
for digital sign and add Microsoft Office document.
So let's switch over to Task one and it's steps in which you have to configure auto enrolment for users.
So step one, for this task, you have to log into along to see one open group policy management and
added the default domain policy.
Then go to the user configuration policies, windows settings, security settings and then click the
highlight public key policies.
Then enable the certificate services client auto enrolment option and then enable renew expired certificates
of dependent certificates and to remove revoked certificates and update certificates that use certificate
templates.
The fifth step is to enable certificate services client.
And finally, close group policy management Ed Rendell and the Group Policy Management Council.
Task two for this exercise is to verify auto enrolment.
So first you have to open Windows PowerShell on long client one and then use be able do flash forth
to refresh group policy.
Then open Microsoft Management console and then add the certificate snapping focused on the user account.
Then verify that you have been issued a certificate based on the ADA to use our template and so on out
of one client one.
After completing this task, switch to Task three rituals configuring the enrollment agent for a smart
card certificate.
So first on one client launch DC one from Certification Authority console.
Open the certificate template console.
Then allow any corner to enrol for the.
Forum Enrollment Agent Certificate and published the Enrollment Agent Certificate Template.
Step four.
You have to sign in to long current one as a date and a password for this user and then enroll for an
enrollment agent certificate.
Sign out of loan class one.
Out on loan to see one.
Open the broker two or three date and see and then configure the restricted enrollment agent so that
any can only issue certificates based on a date and user for the security group marketing.
And finally the task for in which you have to use certificates for digital sign in over Microsoft Office
document.
So it feels like an end to a long planned one, as they did from Administrator.
Open Desert 2016, typed some text in the new blank document and then save the document from click insert
in the ribbon and then insert a signature line.
Fill the signature filled with your data right.
Click the signature line and then choose to sign the document.
Lemme choose a certificate that you enrolled through auto enrolment and after signing the document.
Then make sure that you can alter the document further.
Finally, some out of bloom client one.
When you're done with this exercise to switch to Exercise three, which is configuring and implementing
key recovery.
The scenario for this exercise is another part of establishing a big guy.
You want to configure the test procedures for private key recovery.
You want to assign a key or a certificate for an administrator and configure a C and specific certificate
templates to allow key archival.
In addition, you want to test a procedure for cure of cholera.
The main tasks for this exercise are as follows.
First.
Configure the certification authority to issue cholera certificates.
Second, acquire the KRG certificate.
Third, configure the CAA to allow Kir recovery.
Then configure a custom template for key archival fifth exercises to verify key archival functionality.
So let's start with Task one, in which you have to configure the certification authority to issue KRG
certificates on one beside one in the certification authority console.
Right click the certificates templates folder and then click manage in the certificate templates console
open the key recovery agent certificate properties dialog box sound on the issuance requirements to
clear the sea certificate manager approval check books then on the security DEP.
Notice that only the demand admins and enterprise admins groups have the enrolled permissions.
And finally, right click the certificates templates folder and then issue the key recovery agent template.
Task two in which you have to acquire the KRG certificate first, open the Microsoft management console
and add the certificate snapping for the current user.
Then use the certificate enrollment wizard to request a new certificate and to enroll the KRG certificate
and finally refresh the console, rendering them view.
The key array is in the personal store.
Just three in which you have to configure the Q to allow Q recovery on laundry.
This one.
Open the certification authority console and then open the aid agency properties dialog box.
And on the recovery agent tap click archive the key and then add the certificate by using the key recovery
agent selection dialog box, then restart certificate services when prompted.
After that switch to task for the news, you have to configure a custom template for key archival.
So on launch this one open the certificates templates console.
Step two duplicate the user template and name it to archive user.
Then on the request, count them tab.
Select the archive subjects and groups and private key option by using the archive key option.
The query can obtain the private key from the certificate store.
Then click the subject name tap and then clear the email name and include email name and subject name
checkboxes.
And finally issue the archive user template.
And the last task for this exercise is to verify key archival functionality.
For this, you have to assign them to a long client one as a data Hayden user and open Microsoft Management
Counsel and add the certificate Snow bin for the current user.
Then step three you have to request to enroll a new certificate based on the archive user template after
the from the personal store locate the archive user certificate step five is to delete the certificate
for Reydon to simulate a lost key, then switch along to see one and open certification authority console.
You have to expand to date on C and then click the issued certificate stores.
In the Certification Authority Council.
Note the serial number of the certificate that has been issued for additional Dylan and.
Only I'm disappointed.
Command prompt.
You have to turn the fallen commander 1% or you have to type 30.
Or till this get key.
Insert the serial number and.
Output below.
You have to replace this serial number option with the serial number that you wrote down.
If you copy and paste the serial number, remove the spaces between the number.
Then the next step is to verify the output blob file.
Now displays in the C users administrator folder.
Step 11 is to convert the output block file into an imported dot pef x file.
The command prompt to have the following command serve to tell the recover key o.
Put block 18 dot perfects them and around confirm the password for the certificate and verify the creation
of the recovered key in the C users administrator folder.
Then switch to a loan client while in open file explorer and connect to the loan the AC.
Sorry.
Backslash, backslash.
1231.8 did dot com.
Backslash c and dollar sign when prompted for credentials to use a data administrator with a password.
Learning Corp in the Adam don't be a fax file from this share to see user Adam on loan client one then
on loan client one import the Adam dot perfects certificate and verify the certificate displayed in
the personal store.
This rule around the lab for this course.
If you have some questions and can not perform some task, please consider reviewing the next lecture
in which I'll show all the steps for this lab.