> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/cyber-best-practices/harden-your-environment/implement-certificates/deploying-user-certificates-within-the-active-directory.md).

# Deploying user certificates within the Active Directory

### Installing the AD Certificate Services Role

Install the **"Active Directory Certificate Services"** role on one of your servers. It is important to note that a server hosting this role should be considered highly sensitive and must have a level of protection and monitoring similar to that of a domain controller.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/qugRPa7K0YEkWqPSdMzp/image%20png%20Jan%2010%202024%2003%2028%2042%201006%20PM.png)

Follow the certification authority configuration instructions according to your company’s needs.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/378GSV23yl6peZTkv2uc/image%20png%20Jan%2010%202024%2004%2037%2048%207929%20PM.png)

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/0PrOPZxlIJw676epeILt/image%20png%20Jan%2010%202024%2004%2046%2026%202764%20PM.png)

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/vloZgKuMlmhgy4MHiKYH/image%20png%20Jan%2010%202024%2004%2046%2049%200181%20PM.png)

### Creating a New Certificate Template

Open the Certificate Manager (certsrv) and the **"Certificate Templates"** folder.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/H1IvnPiFHw6YAj801Ke7/image%20png%20Jan%2010%202024%2004%2051%2010%204591%20PM.png)

Right-click on the **"Certificate Templates"** folder, select **"Manage"**, then right-click on **"User"** and finally select **"Duplicate Template"**.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/rXeyXiHwF8tEHTIMpxRR/image%20png%20Jan%2010%202024%2004%2056%2035%202648%20PM.png)

Rename the newly created template to **"User v2"**.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/VSrA4IkPCBQs1LwRzIrl/image%20png%20Jan%2010%202024%2005%2034%2018%200209%20PM.png)

In the **"Security"** tab, enable the permissions **"Read"**, **"Enroll"**, and **"Autoenroll"** for domain users.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/d2JwdODiJipR6VUFiplx/image%20png%20Jan%2010%202024%2006%2008%2050%209697%20PM.png)

If necessary, the application policy of this new template can be modified. In most cases, these certificates will be used for user authentication, so verify that the application policy includes **"Client Authentication"**. You may remove other application policies if desired.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/JZ8qV1aj4Q9JtaNEaOb3/image%20png%20Jan%2010%202024%2005%2041%2039%203930%20PM.png)

In the **"Request Handling"** tab, uncheck the option **"Allow private key to be exported"**.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/bhLfSwVApNX0emjX8vJF/image%20png%20Jan%2010%202024%2005%2058%2030%209538%20PM.png)

Confirm the creation of this new template.

Return to the Certification Authority window (certsrv), right-click on **"Certificate Templates"**, then select **"New"**, and finally **"Certificate Template to Issue"**.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/btW57T0aphuCW6dNAxhr/image%20png%20Jan%2010%202024%2006%2001%2059%203046%20PM.png)

Select the newly created template and click **OK**.

The new template should now appear in the current window.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/WidJFnhD7m8Yy2tMef2C/image%20png%20Jan%2010%202024%2006%2003%2017%201802%20PM.png)

### Enabling Auto-Enrollment for Domain Users

Log in to a domain controller and open the **Group Policy Management** tool. Expand the domain for which you want to enable auto-enrollment, then open the **"Group Policy Objects"** folder. Right-click on **"Default Domain Policy"** and click **"Edit"**.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/PVbYuIrIwQ6PPn1sRaGY/image%20png%20Jan%2010%202024%2005%2048%2026%202963%20PM.png)

Go to:\
\&#xNAN;**"User Configuration" → "Policies" → "Windows Settings" → "Security Settings" → "Public Key Policies"**, then click on **"Certificate Services Client – Auto-Enrollment"**.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/kkMzbf9NvqMML0nf1FOi/image%20png%20Jan%2010%202024%2005%2051%2016%205055%20PM.png)

Select **"Enabled"** for the **"Configuration Model"** option and check the first two boxes:

* **"Renew expired certificates \[...]"**
* **"Update certificates \[...]"**

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/3W3biJJJLTIBEJA5Cv9v/image%20png%20Jan%2010%202024%2005%2053%2018%208052%20PM.png)

Then click **OK**.

Simply click **OK** again and close the GPO.

From a domain user session, type **"gpupdate /force"** and wait for the GPO to apply. A certificate should then appear in your certificate store. If not, use the command **"gpresult /r"** to ensure that the GPO has been applied correctly.

In the image below, the certificate of the user **"Administrator"** is visible.

![](https://content.gitbook.com/content/jlP9dfgnu6hj9gyZJG1g/blobs/zm1azmq7AcEafrCKUfyo/image%20png%20Apr%2015%202024%2004%2034%2036%208776%20PM.png)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/cyber-best-practices/harden-your-environment/implement-certificates/deploying-user-certificates-within-the-active-directory.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.