Setup automatically enrolling User and Computer Certificates in Active Directory with GPO

## Introduction

We want to setup our home network with Active Directory and Certificate Services to use 802.1X authentication, to keep unwanted guests to a minimum. To make it easy for everyone in the house... and me we will setup our home domain computers, and users to auto enroll for certificates when they log in below is a logical map of the network:

## Steps

1. Create user certificate template
2. Create computer certificate template
3. Create and assign a GPO to auto enroll users and computer with CA, and configure wired 802.1x Options
4. Configured the wired policy
5. Verify the CA is issuing certificates

## Prerequisites

To accomplish this you must have already imported the CA certificate into your Domain Controller's Trusted Root CA Store

## Detailed Steps

### Create Templates

Step 1: Login to your certificate server, from there open the certification authority application

Step 2: Click to expand your server and then right-click on certificate templates and select Manage

Step 3 in the window that pops up scroll down and right-click on the template labeled user and select duplicate Template

Step 4 in the pop up window make sure you make the following sections

Under the General tab Give your template a name to make it easy to distinguish and locate later. In this example I gave my template the Name GPO-User

Under request handling ensure that allow private key to be exported is not checked

Under Extensions with application policies highlighted click edit, in the pop up window click add, in that new pop window locate "server authentication" and click ok

under security ensure that domain users is present and has Read, Write, Enroll, and Autoenroll privileges

under subject name ensure that User Principal Name (UPN) is selected, then click ok to close this window

Step 5 Right click on the computer template and select Duplicate Template

Under the General tab Give your template a name to make it easy to distinguish and locate later. In this example I gave my template the Name GPO-Computer

Under request handling ensure that allow private key to be exported is not checked

Under Extensions with application policies highlighted click edit, in the pop-up window click add, in that new pop window locate "server authentication" and click ok

under security ensure that domain computers is present and has Read, Write, Enroll, and Autoenroll privileges

under subject name ensure that User Principal Name (UPN), and DNS name are selected

once that is done click okay to close the window,

Step 6 right-click on certificate template and select **new > Certificate Template to issue** when the next window pops up and select both of the templates that you created.

after that, you can close Certification Authority

### Group Policy

Step 6 log in to the Domain controller and open Group Policy editor

Step 7 Create Right Click on the domain and select "create a GPO in this domain, and Link it here.."

Step 8 enter a new Name for your GPO in this window

Step 9 right click on your newly created GPO and select edit

Step 10 under navigate to Computer configuration > policies > Windows Settings > Security Settings

\*under System Services scroll down to Wired auto config - double click on it and select the define this policy setting box and set the service startup mode to automatic.

Right-Click on Wired network (802.3) policies and select "Create a new Wired Network Policy for Windows Vista and Later releases"

On the General Tab give you new policy a name and description I named my policy Dot1X. also ensure the "Use Windows Wired Auto Config service for clients"

on the security tab keep the "Select a network authentication method" set to Microsoft: Protected EAP (PEAP) and click the Properties button.

in this new window ensure the Checkbox next to "Verify the Server's identity by validating the certificate" please note that for this to work you must your own private CA certificates deployed for this to work in a demo/test

under the trusted root certification Authorities scroll down to your CA servers (you have to click on both CA servers) then at the bottom where it says "Select authentication Method" change the value to "Smart Card or Other Certificate" Click the Configure button and in the "Trusted Root Certification Authorities" select the two certificates from your Root CA'

Click Ok to Close the windows

Step 11 go to Public Key Policies and double click on Certificate Service Client - Auto-Enrollment

In the pop-up window change Configuration Model: to enabled and make sure both of the checkboxes are checked (see picture)

Step 12 Navigate to User Configuration > Policies > Windows Settings > Security Settings. once there double click on Certificate Services Client - Auto-Enrollment Settings.

in the pop-up window change Configuration Model: to enabled and make sure both of the checkboxes are checked (see picture)

for there you can close the Group Policy editor

Step 13 Verification. if everything is set up correctly, you can reboot your domain computer and sign into it. once signed in to your CA server and open the Certification Authority App

Step 14 once in the app go to Issued Certificates and you should see certificates issued using your templates from the GPO we created.