Administration

Prepare Active Directory for Smart Card Authentication
You might need to perform certain tasks in Active Directory when you implement smart card
authentication.
n
Add UPNs for Smart Card Users on page 50
Because smart card logins rely on user principal names (UPNs), the Active Directory accounts of users
and administrators that use smart cards to authenticate in View must have a valid UPN.
n
Add the Root Certicate to the Enterprise NTAuth Store on page 51
If you use a CA to issue smart card login or domain controller certicates, you must add the root
certicate to the Enterprise NTAuth store in Active Directory. You do not need to perform this
procedure if the Windows domain controller acts as the root CA.
n
Add the Root Certicate to Trusted Root Certication Authorities on page 51
If you use a certication authority (CA) to issue smart card login or domain controller certicates, you
must add the root certicate to the Trusted Root Certication Authorities group policy in Active
Directory. You do not need to perform this procedure if the Windows domain controller acts as the
root CA.
n
Add an Intermediate Certicate to Intermediate Certication Authorities on page 52
If you use an intermediate certication authority (CA) to issue smart card login or domain controller
certicates, you must add the intermediate certicate to the Intermediate Certication Authorities
group policy in Active Directory.
Add UPNs for Smart Card Users
Because smart card logins rely on user principal names (UPNs), the Active Directory accounts of users and
administrators that use smart cards to authenticate in View must have a valid UPN.
If the domain a smart card user resides in is dierent from the domain that your root certicate was issued
from, you must set the user’s UPN to the Subject Alternative Name (SAN) contained in the root certicate of
the trusted CA. If your root certicate was issued from a server in the smart card user's current domain, you
do not need to modify the user's UPN.
N You might need to set the UPN for built-in Active Directory accounts, even if the certicate is issued
from the same domain. Built-in accounts, including Administrator, do not have a UPN set by default.
Prerequisites
n
Obtain the SAN contained in the root certicate of the trusted CA by viewing the certicate properties.
n
If the ADSI Edit utility is not present on your Active Directory server, download and install the
appropriate Windows Support Tools from the Microsoft Web site.
Procedure
1 On your Active Directory server, start the ADSI Edit utility.
2 In the left pane, expand the domain the user is located in and double-click CN=Users.
3 In the right pane, right-click the user and then click Properties.
4 Double-click the userPrincipalName aribute and type the SAN value of the trusted CA certicate.
5 Click OK to save the aribute seing.
View Administration
50 VMware, Inc.