The Active Directory Sites and Services snap-in is where you adjust permissions for enterprise-wide services, including the use of certificate templates and other PKI components.
You will perform this exercise on an enterprise CA.
- Open the Active Directory Sites And Services snap-in.
- Highlight the main node for the domain, then right-click the node and choose View ? Show Services Node.
- Expand Services ? Public Key Services, and choose Certificate Templates node. This fills the right half of the MMC window with a list of installed templates.
- Right-click the template whose permissions you want to set, then choose Properties. When the Properties dialog box appears, switch to the Security tab.
- Adjust the permissions to suit your needs. To keep users from using the template to request new certificates, make sure that you deny the appropriate groups the Enroll permission. Close the Active Directory Sites and Services tool.
