Certificates and Auto-enrollment 1

[navigat0]

Can anyone tell me if it's possible to modify the Code Signing certificate template or Policy for this template to allow auto-enrollment like you can do with user certificates?

Background: We are using enterprise wide code signing certificates along with very high security for macro's in office (MSExcel) documents. Currently users are self-signing, I have tested using enterprise code signing certificates but would like to reduce the amount of user intervention by setting up auto-enrollment so that when users log into the domain they automatically obtain a code signing certificate for those purposes.

Thanks!

 

[aftertaf]

there is a policy for certificate auto enrollment.

Certificate Autoenrollment in Windows XP
Not sure if this only applies to 2003/XP though...

Aftertaf

"Solutions are not the answer." - Richard Nixon

 

[navigat0]

That's correct, unfortunately as you can see from the snapshots in the article you posted the auto-enrollment feature is supported for USER and COMPUTER certificates only. As my digging turned up answers - what I found was that code-signing certificates (as well as some other extended types of certificates) can only be configured for auto-enrollment if you are using XP clients and Windows 2003 Server ENTERPRISE EDITION. I, uluckily enough, run Win2K3 Standard servers as well as a mix of Win2K and XP clients.

 

[mlichstein]

Autoenrollment of ALL certs is only supported on the 2003 Enterprise SKU. It also requires XP clients.

What you are referring to is Automatic Certificate Request. This runs on all versions of 2000 and 2003 Server, and supports 2000 and XP clients.

Autoenrollment requires Version 2 certificate templates, which are only available on 2003 Ent and higher. Version 2 templates allow you to configure all properties of the template. Version 1 templates have very limited options, basically just a security ACL. You can look at the options available to Version 1 templates by going into the CA console, right clicking on templates, then clicking manage. Then you can look at the properties of the templates listed there.