4.6

What to do next
If an intermediate certification authority (CA) issues your smart card login or domain controller certificates,
add the intermediate certificate to the Intermediate Certification Authorities group policy in Active Directory.
See “Add an Intermediate Certificate to Intermediate Certification Authorities,” on page 28.
Add an Intermediate Certificate to Intermediate Certification Authorities
If you use an intermediate certification authority (CA) to issue smart card login or domain controller certificates,
you must add the intermediate certificate to the Intermediate Certification Authorities group policy in Active
Directory.
Procedure
1 On your Active Directory server, select Start > All Programs > Administrative Tools > Active Directory
Users and Computers.
2 Right-click your domain and click Properties.
3 On the Group Policy tab, click Open to open the Group Policy Management plug-in.
4 Right-click Default Domain Policy, and click Edit.
5 Expand the Computer Configuration section and open Windows Settings\Security Settings\Public
Key.
6 Right-click Intermediate Certification Authorities and select Import.
7 Follow the prompts in the wizard to import the intermediate certificate (for example,
intermediateCA.cer) and click OK.
8 Close the Group Policy window.
All of the systems in the domain now have a copy of the intermediate certificate in their intermediate
certification authority store.
Add the Root Certificate to the Enterprise NTAuth Store
If you use a CA to issue smart card login or domain controller certificates, you must add the root certificate to
the Enterprise NTAuth store in Active Directory. You do not need to perform this procedure if the Windows
domain controller acts as the root CA.
Procedure
u
On your Active Directory server, use the certutil command to publish the certificate to the Enterprise
NTAuth store.
For example: certutil -dspublish -f
path_to_root_CA_cert NTAuthCA
The CA is now trusted to issue certificates of this type.
VMware View Installation
28 VMware, Inc.