Re: Root certificate authority no longer added to client machines
- From: Paul Adare <padare@xxxxxxxxxxx>
- Date: Fri, 15 Dec 2006 08:54:20 -0500
In article <OJNXItEIHHA.3616@xxxxxxxxxxxxxxxxxxxx>, in the
microsoft.public.security news group, Stuart Hudman <a@xxxxx>
says...
I have read as many articles/KB that I can and would like some clarification
if anyone can,
PLEASE!!.
We have a standalone RootCA, with Enterprise issuing CAs. We have ran
DSpublish for the RootCA into the AD, but clients do not get entries added
to
their trusted store.
What OS is running on your domain controllers? If you're running
Windows Server 2003 then you should be publishing the root
certificate with certutil and not dspublish.
From what I understand, and read many times, is things
like: "When you install an enterprise root CA or a stand-alone root CA, the
certificate of the CA is added automatically to the Trusted Root
Certification Authorities Group Policy for the domain.". Well, if this is a
standalone Root, how the heck does it put it into a GPO ? Another article
states, that if the client is a domain member, then they will automatically
receive the CAs in the trusted store....but negates to say how.
So...in a complete Microsoft world (RootCA, SubEntCAs and clients)...how
does the trusted store get populated on a client ? Do you need a GPO or not
? Is it a sub-process of auto-enrollment ?
If the standalone certificate is _properly_ published to the the
directory then Group Policy will ensure that is installed on all
Windows clients in the forest. Note that Group Policy is the
publishing mechanism, there's no need to create a specific GPO
to do this.
--
Paul Adare - MVP Virtual Machines
Waiting for a bus is about as thrilling as fishing,
with the similar tantalisation that something,
sometime, somehow, will turn up. George Courtauld
.
- Follow-Ups:
- References:
- Root certificate authority no longer added to client machines
- From: Stuart Hudman
- Root certificate authority no longer added to client machines
- Prev by Date: Root certificate authority no longer added to client machines
- Next by Date: Re: Does Norton AV send emails ?
- Previous by thread: Root certificate authority no longer added to client machines
- Next by thread: Re: Root certificate authority no longer added to client machines
- Index(es):
Relevant Pages
|
