Right now, I'm doing the following to request a cert from a CEP server:

  • Open gpedit.msc
  • Under Computer Configuration > Windows Settings > Security Settings > Public Key Policies, double click "Certificate Services Client - Certificate Enrollment Policy"
  • Enable
  • Enter the CEP URI
  • Switch to Username/Password authentication
  • Validate (Provide Creds)
  • Open MMC, and import Certificates snap in
  • Go to Certificates > Personal
  • Right-Click > Request New Certificate
  • Enter "more information" (CN, DNS Name, etc.)
  • Provide Creds

After this I have a cert from the CEP; however, this is a painful process to do manually. Is there any way to automate this in Server 2008 (and 2012)? All information that I can find about this tells how to install the CEP services to make a server an enrollment policy server (nothing about actually requesting a new cert, or enabling it on the client side). Is it possible to automate this?

It looks like this process adds a lot of data under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Cryptography. Can I manually add this (and spoof a GUID/ServiceID)?

  • 1
    Not to discourage your enthusiasm, as I also like to POWERSHELL ALL THE THINGS!!!!!! but the group policy cmdlets are still absolutely horrid, and the PKI cmdlets are much improved in v4 over v3, so... :( However, I do find this 3rd party PKI module for PowerShell module useful, and it may take some of the manual pain out what you're trying to do. – HopelessN00b Dec 16 '14 at 1:29

I presume your certificate requests are made using a template. If that's the case then use the Public Key Policies/Certificate Services Client - Auto-Enrollment Settings GPO to enforce auto enrollment. You'll also want to ensure the template ACL has Enroll and AutoEnroll marked for either domain computers or domain users (or whatever acl object, depending on the intended audience) There's a user config and computer config policy to leverage depending on whether or not it's a machine cert or user cert you're trying to push. Enrollment begins as soon as when the policy is pushed (usually about 15 minutes) after the GPO is linked and enforced.

  • 2
    Well, duh. I got so hung up on the PowerShell part, I totally blanked on the fact that I've set up many, many GPOs to automate certificate enrollment for many years. D'oh! Good catch. – HopelessN00b Dec 17 '14 at 22:40
  • This is definitely an option (probably the best option), but I would prefer to set a local group policy setting.. is this possible? – EGr Dec 18 '14 at 20:35
  • 2
    @EGr why in the world would you want to do that? – MDMoore313 Dec 18 '14 at 20:50
  • @HopelessN00b I did the same thing, however it would be cool to have a powershell way to do it for troubleshooting purposes at the very least, so it's still a pretty good question. – MDMoore313 Dec 18 '14 at 20:51

I don't have a complete solution, however, I can advice start points. My PowerShell PKI module has an ability to register enrollment service endpoint starting with Windows 7/Windows Server 2008 R2 (note that Windows Server 2008 do not support enrollment services). Here is an example how to register a policy: http://en-us.sysadmins.lv/Lists/Posts/Post.aspx?ID=101

regarding enrollment. This blog post series may give you some insight about how to utilize CertEnroll COM interfaces to perform certificate enrollment in PowerShell. There is nothing about enrollment web services (unfortunately), but the techniques are the same. You will need to start with this interface: IX509CertificateRequestPkcs10V2


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.