Manually running the autoenrollment process

By default, all domain members automatically replicate the Public Key Services object of the Active Directory forest through the autoenrollment process. The triggers for this are:

  • When the user logs on (for computers, when the computer account logs on, i.e. at system startup).
  • By timer every 8 hours.
  • When updating Group Policy, assuming there has been a change.

If you do not want to wait for the autoenrollment to be triggered automatically, you can start it manually. The different ways to run the autoenrollment process are described below.

Continue reading "Manually running the autoenrollment process"

How secure is the "Allow private key to be exported" setting in the certificate templates?

PKI administrators often assume that the option in the certificate template not to allow the private key to be exported is binding.

However, that is not the case.

Continue reading "How secure is the "Allow private key to be exported" setting in the certificate templates?"