Re: 2003 PKI Design Question

From: Paul Adare (padare_at_newsguy.com)
Date: 02/25/05 

Date: Fri, 25 Feb 2005 17:45:12 -0500

In article <OKuE#0zGFHA.3484@TK2MSFTNGP12.phx.gbl>, in the
microsoft.public.windows.server.security news group, Eric O'Callaghan
<eric_ocallaghan@hotmail.com> says...

> Can I have both the issuing CA that is chained to the external root CA and
> the internal PKI publish certs to AD? I really want to avail of the auto
> enrollment features of 2003/XP.
>

Yes, but you're not understanding how autoenrollment works. There is no
requirement that the certificates be published to Active Directory when
enabling autoenrollment. 

-- 
Paul Adare
"On two occasions, I have been asked [by members of Parliament],
'Pray, Mr. Babbage, if you put into the machine wrong figures,
will the right answers come out?' I am not able to rightly apprehend
the kind of confusion of ideas that could provoke such a question."
-- Charles Babbage (1791-1871)