PKI- Need HELP getting new CA published in enrollment services container
ok after few weeks of headaches figured out problem is. should included in next cross-forest certification whitepaper no 1 else has deal. anyway, when have windows 2008 enterprise ca in own forest , you're trying to use the cross-forest certificate enrollment other forest's schema at windows 2003 level then autoenrollment work, cannot use of the new features of windows 2008 ca.
basically when install certificate services on 2008 ca machine, not install of roles. can install "certification authority" , "certification authority web enrollment" roles if want auto enrollment work. reason because when try using pkisync.ps1 script provided microsoft copy objects resources forest account forest, error cannot copy object in enrollment services container if have other roles installed. because when install other roles, ad object in enrollment services container has new attributes windows 2003 doesn't know with. because of this, object not copy over. autoenrollment not work in 2003 forest if object not copied over.
once upgrade schema windows 2008, the available roles can be installed , configured , able use the new features of windows 2008 ca in cross forest pki environment.
note if you need have role services installed, web enrollment in account forest work fine. also, if have 2-tier pki structure , have all of roles installed, can keep the resource forest way , install 2008 member server in account forest based on root ca. once upgrade schema 2008, can decommission ca in account forest , use pkisync script to copy objects from resource forest account forest and the enterprise ca in resource forest will work should.
if have installed roles , you're having issue, can uninstall new roles not supported 2003 schema , once use pkisync script , have group policy setting in place for users , computers autoenroll should start working should. best of luck.
Windows Server > Security
Comments
Post a Comment