Is It certificate required for all administrators?

Question

Is It certificate required for all administrators oe everyone in general?

Answer 1

Certificates are not required for all administrators or for everyone in general in Windows Server/Active Directory environments.

Certificates are required only when a specific feature or scenario depends on them, for example:

• Smart card sign-in: User and admin accounts that must sign in with smart cards need appropriate smart card logon certificates mapped to their accounts. A single certificate can be mapped to multiple accounts or multiple certificates to a single account, depending on the design, but this is only for accounts that actually use smart card sign-in.
• TLS/SSL for services: Servers running services such as web sites, Exchange Server, Skype for Business Server, SQL Server, etc., need server certificates so clients can connect securely. Only the servers and roles that provide these services need those certificates.
• Secure Boot and platform security: Devices rely on firmware-level certificates (for example, Secure Boot CAs) to validate boot components. This is a platform requirement, not a per-admin or per-user requirement.

In practice, certificates are deployed where needed:

• To specific user or admin accounts that must use certificate-based authentication (for example, smart cards).
• To specific servers and roles that must provide encrypted or signed communications.

There is no general requirement that every administrator or every user must have a certificate unless an organization’s own security policy mandates it.

---

References:

• Certificate Requirements and Enumeration
• Secure Boot Certificate updates: Guidance for IT professionals and organizations