Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows Server provides a certificate authority service. However, it's not clear from its documentation how (or if) the root certificate gets distributed to clients.

  • Do domain member computers automatically trust the root certificate?
    • If so, how and when do they get the certificate?
  • Is there any user interaction required for the root certificate to be installed or trusted?
  • Does the client poll Active Directory? Is it in AD DNS?
  • Will it only get it during login?
  • What if a domain member remotely VPNs into the LAN?
  • Are there any caveats for different versions of Windows clients?
share|improve this question
up vote 15 down vote accepted

The method used for distribution depends on the type of CA you setup (standalone/enterprise).

For a standalone or non-microsoft CA you generally distribute this with a group policy.


When you install an Enterprise certificate authority in a domain, this happens automatically.


When you install an enterprise root CA, it uses Group Policy to propagate its certificate to the Trusted Root Certification Authorities certificate store for all users and computers in the domain.

share|improve this answer
Using group policy implies that it only happens during login while connected to the domain, right? So someone that logs in and the connects to the domain via VPN is out of luck? – wfaulk Feb 10 '12 at 23:06
Kinda depends on the VPN. I haven't done since Windows 2003, but you could actually have the VPN initiated at logon, and policies/login scripts would apply. Not sure if that is possible any more, and it would be a lot less likely to work with a 3rd party VPN. – Zoredache Feb 10 '12 at 23:09
Login with with network for Windows 7 -… – Zoredache Feb 10 '12 at 23:18
Actually, if I'm rereading that correctly, it says that it uses GP to push the cert to a certificate store. How do clients retrieve it? Or am I misreading? – wfaulk Feb 10 '12 at 23:22
The Enterprise CA pushes the cert into a GPO. The machines apply the GPO, which and thus install the CA into the trusted store. I believe the Enterprise CA publishes to the 'Default Domain Policy'. – Zoredache Feb 10 '12 at 23:27

It's my experience that once you setup the CA and the Cert is stored in ADDS, a computer will grab it on next boot and store in the computer trusted root store. I generally put CA's in all AD domains I manage as it opens up options for using CA for all your certificate needs with out any additional work for domain member computers. This includes the Windows Server 2008 R2 SSTP VPN or L2TP IPSec which uses certificates. Traditional PPTP does not use certificates.

Slightly unrelated, but if you want people to VPN in during login, you should use GPO to push a VPN config or when you manually create the VPN on a computer check the "make available for all users" box which stores the VPN config in the public profile rather then the specific users profile. Once that's done, before login, click the switch user button (vista/7) and you'll see a new VPN icon bottom right by the shutdown button. That solves the problem of "a new user logging in without being on the network first".

Lastly, when you create the root CA, be sure it's running Windows Enterprise or the Certificate Service will be crippled (in Standard ed.) and I wouldn't make the expiration less then 10 years to save you some work in the future.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.