Install and Configure AD CS

Question 1

How do you install Active Directory Certificate Services?

Answer 1

Through the Add Roles and Features wizard in Server Manager via the AD CS role.

Question 2

What are the requirements to install an Active Directory Integrated CA?

Answer 2

1. Must have AD CS role installed.
2. Host must be domain-joined.
3. User must be a member of Enterprise Admins group.

Question 3

How do you install an AD Integrated CA?

Answer 3

1. Install AD CS role

2. Within AD CS Config wizard, choose Enterprise CA on CA Type screen.

Question 4

What are the requirements to install a standalone CA?

Answer 4

1. Must have AD CS role installed.

2. User must be a member of Local Administrator group

Question 5

When setting a root and subordinate CA structure, which CA type is preferred, Enterprise or Standalone?

Answer 5

Standalone

Question 6

What management tool is used to manage CAs?

Answer 6

Certification Authority

Question 7

How do you update the CRL?

Answer 7

Within CA tool, with the root CA selected, right click on Revoked Certificates and select All Tasks > Publish

A Publish CRL pop-up box will appear to create a new CRL, select New CRL > Ok

Question 8

How do you install a subordinate CA?

Answer 8

1. Install the AD CS role and CA Web Enrollment role service
2. Within the AD CS Config wizard, specify Subordinate CA
3. Move recently created Certificate request to a network share to be grabbed by Root CA server
4. On Root CA server within AD CS, submit new certificate request and issue when complete
5. Copy Issued Certificate to a file and place on network share to be reached by subordinate CA server
6. Install Security Cert and CA Cert (from File Explorer and AD CS respectively)
7. Create Public Key Infrastructure in a network share on the subordinate CA server
8. Create Web Server utilizing IIS Manager
9. Create forward lookup zone of web site (pki.domain.com)
10. Within Certification Authority on subordinate CA server, start service

Question 9

How do you install Online Responder?

Answer 9

On a member server, install the AD CS Online Responder role

Question 10

How do you implement administrative role separation?

Answer 10

Security groups can be assigned CA permissions within AD CS to fulfill role separation.

Question 11

How do you perform a back up of the CA?

Answer 11

Within Certification Authority, right click on CA server and select All Tasks > Back up CA

Question 12

How do you perform a restore of the CA?

Answer 12

Within Certification Authority, right click on CA server and select All Tasks > Restore CA