Administration

Procedure
1 Log in to the virtual machine operating system as an administrator and start Server Manager.
2 Select the seings for adding roles.
Operating System Selections
Windows Server 2012 R2
a Select Add roles and features.
b On the Select Installation Type page, select Role-based or feature-
based installation.
c On the Select Destination Server page, select a server.
Windows Server 2008 R2
a Select Roles in the navigation tree.
b Click Add Roles to start the Add Role wizard.
3 On the Select Server Roles page, select Active Directory  Services.
4 In the Add Roles and Features wizard, click Add Features, and leave the Include management tools
check box selected.
5 On the Select Features page, accept the defaults.
6 On the Select Role Services page, select  Authority.
7 Follow the prompts and nish the installation.
8 When installation is complete, on the Installation Progress page, click the  Active Directory
 Services on destination server link to open the AD CS Conguration wizard.
9 On the Credentials page, click Next and complete the AD CS Conguration wizard pages as described
in the following table.
Option Action
Role Services
Select  Authority, and click Next (rather than ).
Setup Type
Select Enterprise CA.
CA Type
Select Root CA or Subordinate CA. Some enterprises prefer two-tier PKI
deployment. For more information, see
hp://social.technet.microsoft.com/wiki/contents/articles/15037.ad-cs-step-
by-step-guide-two-tier-pki-hierarchy-deployment.aspx.
Private Key
Select Create a new private key.
Cryptography for CA
For hash algorithm, you can select SHA1, SHA256, SHA384, or SHA512.
For key length, you can select 1024, 2048, 3072, or 4096.
VMware recommends a minimum of SHA256 and a 2048 key.
CA Name
Accept the default or change the name.
Validity Period
Accept the default of 5 years.
Certificate Database
Accept the defaults.
10 On the Conrmation page, click , and when the wizard reports a successful conguration,
close the wizard.
11 Open a command prompt and enter the following command to congure the CA for non-persistent
certicate processing:
certutil -setreg DBFlags +DBFLAGS_ENABLEVOLATILEREQUESTS
12 Enter the following command to ignore oine CRL (certicate revocation list) errors on the CA:
certutil -setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE
This ag is required because the root certicate that True SSO uses will usually be oine, and thus
revocation checking will fail, which is expected.
Chapter 5 Authenticating Users Without Requiring Credentials
VMware, Inc. 79