• A multi-tiered Active Directory (AD) where tier-specific admin accounts are restricted to log on to only their tier servers.
  • Microsoft's Certificate Services (CS).

Let's say the CA tier is A and the admin requesting a Code Signing certificate is in tier C. The Code Signing certificate is a user-specific certificate. Since the admin in tier C is not allowed to log on to tier A, the admin will get an error.

Tiered AD environments have been around for some time, there should be a way for everyone to request certificates over the domain when given appropriate privileges in the certificate template. I have given Enroll privileges to all of my test admins in all tiers.

Requesting the same certificate in tier A was a success. Also, requesting machine-specific certificates from tier C works fine, since the log on restrictions apply to user accounts only.

The question is then, how would one configure AD and/or CS to allow all admins to request user-specific certificates from CS?

Making exceptions in the Deny access this computer from the network GPO is not an option since this would invalidate the tiering model.

I just thought that one way would be to set up additional tier-specific CS's, but that is a massive overkill to serve lower-tiered accounts user-specific certificates only. And creating a CS in tier D seems like asking for trouble. Is this a thing?

  • Your tiering model doesn't look right, because primary security boundary in AD DS is forest, not domain. If CA cannot authenticate client, all requests will fail. You need to allow your users to be authenticated on CA.
    – Crypt32
    Dec 14, 2023 at 13:36
  • Computers and regular users can authenticate and request certificates.The privileged accounts should not move between tiers, but regular users should not be used in tiers above the user space?
    – Ramil
    Dec 14, 2023 at 17:05


You must log in to answer this question.

Browse other questions tagged .