We want to force Remote Desktop to use a certificate based on a particular named template rather than using a self-signed certificate. This works in forests with a Certificate Authority server, but not in forests that do not have their own CA server. I want to avoid hardcoding the certificate thumbprint to use on each computer as this would need to be updated each time the certificate is renewed.
We have a number of Active Directory domains (one domain per forest) which have Microsoft Enterprise CAs (one CA server per forest). These original domains/forests do not trust each other and are firewalled from each other. All our servers are using Windows Server 2016.
The certificate templates were generated on one CA, then copied to the other CAs. None of the certificate templates have the extension "Remote Desktop Authentication" (126.96.36.199.4.1.3188.8.131.52). Each server in the domain has a certificate based on a template with the "Server Authentication" extension, and we have a GPO with the setting "Server Authentication certificate template" configured with the name of the certificate template we want to use with RDP. This seems to work fine in the domains/forests that have a CA.
To support application development by third parties, we built additional forests, one for each of the original forests, and each of the new forests trusts its corresponding original forest. The development forests do not have CAs - their certificates are issued by the CA in their corresponding original forest. The development forests have GPOs that are generally copies of the GPOs in their corresponding original forest.
If I look at a certificate in the main forests which have CAs, at the property "Certificate Template Information", the value shown is of the form "Template=
OID)...". In a domain without a CA server, the value shown is of the form "Template=
OID" (i.e. no display name, only an OID). I believe that is the reason that the GPO setting is having no effect in the forests without a local CA.
I used the scripts here: https://www.sysadmins.lv/blog-en/export-and-import-certificate-templates-with-powershell.aspx to copy the Certificate Templates and OIDs from one of the forests with a CA to its corresponding development forest. Although the process was successful, this did not help with the resolution of OID to display name for the certificates and did not make the GPO setting work. I noticed that the OIDs of the templates were different when transferred to the new domain (I looked in AD Sites and Services under "Public Key Services". I also tried the module at: https://www.powershellgallery.com/packages/ADCSTemplate/184.108.40.206 which gave similar results.
Is there an easy way, without changing the original certificate templates or creating new ones, that we can have a single GPO (copied between all of the forests) to specify the certificate template to use with RDP, or do we have to have separate GPOs in the development forests which have the OID of the certificate template rather than the display name?