Setting up PKI in Configuration Manager

Question

I am currently setting up PKI in my Endpoint Configuration Manager environment. Every article I read mentions checking Read, Enroll and AutoEnroll for Domain Computers uder the security tab of the client certificate. None how ever say anything about Domain Controllers. We manage our Domain Controllers just like we do any other client. Should I add Domain Controllers to the template or do something else?

Answer 1

Hello,

there are 2 templates that Microsoft has planned for this purpose:

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-pki

Domain Controller
Domain Controller Authentication

You should be able to use one of both to reach your goal.

Best regards,

Answer 2

There is 2 templates for Domain Controllers
"Domain Controller"
"Domain Controller Authentication" --> SmartCardLogon authentication

You should use one of this template for the DC's

hth