AD CS: Setting Up Computer Certificate Authentication

Adding the Authentication Template for Workstations

From the AD CS server, we'll create a certificate template for our workstations, which will enable us to generate the certificates used for computer authentication.

• Open the Certification Authority management console:

• Open the Certificate Templates Console by right-clicking on the Certificate Templates folder and selecting Manage:

• Right-click on the Workstation Authentication template and select Duplicate Template:

• Optional, but if you have a recent architecture, set the Compatibility Settings to the most recent systems:

• Give the Template a name:

• Increase key size for greater security:

• To enable automatic deployment of certificates via GPO, check the Autoenroll box for Domain Computers:

Finally, click OK to create the template.

• From the Certification Authority management console, right-click on Certificate Templates and select Certificate Template to Issue:

• Select the Workstation_Auth_EAP-TLS template created earlier:

• The Workstation_Auth_EAP-TLS template should appear in the Certificate Templates folder:

Configure NPS

We need to configure our NPS server (which is the RADIUS server in the Microsoft ecosystem) to accept authentication for a group of computers. I will not go into the complete installation process here, because I have already explained it: here.

I'll describe below how to create a Network Policy in which we define the group of computers that can connect to the network and the protocols used.

• From the Network Policy Server console, click New in the Network Policies folder:

• Give Policy a name:

• Click on Add to specify the condition:

• Select Machine Groups, then click on Add Groups…:

• Add an Active Directory computer group, such as Domain Computers:

• Click on Next:

• Select Access granted:

• Choose Microsoft: Smart Card or other certificate as the EAP type and edit the configuration:

• Select the certificate previously issued:

• Click on Next:

• Click on Next again:

• Finally, click on Finish to create the Policy:

Deploying Certificates

Once AD CS is properly configured, we can request a Workstation certificate from any domain-joined computer.

Manually from the Certificate Management Console

• From a user computer, open the Certificate Management Console for the current computer:

• Right-click on the Personal folder and select Request New Certificate…:

• Click Next to start the certificate enrollment process:

• Select the Active Directory Enrollment Policy and click Next to continue:

• Select the previously defined Workstation policy and click Enroll:

• Simply click on Finish when the enrollment process is complete:

• After clicking Refresh, your computer's certificate appear: