- Your Equipment Shopping List
- Installing the Enterprise CA
- Forcing Smartcard Logons
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
Installing the Enterprise CA
After you've acquired the smartcard readers and installed them on each computer, you need to prepare the smartcards. Each smartcard requires a certificate. To get that certificate on each smartcard, you need a certification authority (CA). To issue smartcard certificates, you need an Enterprise CA server. Most of the particulars for the installation of the CA aren't significant when it comes to simply issuing the smartcard logon certificates. However, they may be important if you have other things planned for your CA.
If you don't already have a CA and you have no real preference on how to install it, you can follow these steps:
Log on as a member of the Enterprise Admins group.
Open the Windows Control Panel, open Add/Remove Programs, and click Add/Remove Windows Components.
The Certificate Services option is in the list of Windows components. Select that option and follow the wizard to install. The first thing you'll see is a warning message telling you that you cannot change your machine name or domain membership. Keep that in mind, click OK, and then click Next.
When the CA Type selection box appears, make sure that you're installing an Enterprise CA and then click Next.
In the CA Identifying Information box, enter a name for your CA and then click Next.
In the Certificate Database Settings dialog box, leave the default settings (unless you know that you want to change them) and click Next. You'll need the CD-ROM or installation files in a couple of seconds.
If you don't have Internet Information Services (IIS) installed, you'll be prompted to install IIS to get web enrollment working. If you don't plan to do any web enrollment, you can just click OK and don't worry about it. Click Finish when it's all over.
Next, you need a smartcard logon certificate template.
Creating the Template
After you have the CA installed, you need to manage it a bit. Create an MMC with the following snap-ins:
Active Directory Users and Computers
Certification Authority
Certificate Templates
Now that you have the console configured, click Certificate Templates and look for the Smartcard Logon certificate in the right-hand pane. Right-click the Smartcard Logon template and select Duplicate Template.
At this point, you get a Properties of New Template dialog box, as shown in Figure 2. (Name your template whatever you want.) Be sure to select Publish Certificate in Active Directory if the box isn't already checked.
)
Figure
2 Configuring the certificate template properties.
Click the Request Handling tab and then select Signature and Smartcard Logon in the Purpose drop-down list. You want the user to be prompted to insert a smartcard during logon, so select the option Prompt the User During Enrollment (see Figure 3).
)
Figure
3 Setting the proper request handling.
Before you leave this dialog box, click the CSPs button near the bottom to open the CSP Selection dialog box, where you can select the appropriate cryptographic service provider (CSP). For example, I use a smartcard produced by Schlumberger, so I chose the Schlumberger CSP, as shown in Figure 4.
CAUTION
Some people think that they can choose pretty much anything here, but that isn't quite the case. What you select affects what the user sees on the other end. For example, if I selected the Infineon SICRYPT Base Smartcard CSP, I'd be prompted to insert my SICRYPT smartcard on the client side.
Select only the applicable CSP(s) for the smartcards you purchased. As I said earlier, this process is easier if you have only one type of smartcard and reader. If you have more than one smartcard type, you'll have to select multiple CSPs. Later in this article, you'll see how having multiple CSPs affects the user.
)
Figure
4 Selecting the appropriate CSP(s).
After clicking OK in the CSP Selection dialog box, you return to the Properties dialog box for the template you're setting up. Click the Security tab. If you want to allow all users in your Domain Users group to receive certificates during logon, you must add them to the Access Control List (ACL) for this template. Be sure to give them the rights to Read, Enroll, and Autoenroll, as shown in Figure 5.
)
Figure
5 Configuring certificate template permissions.
Click OK. The template is ready. Now that you have the smartcard logon template duplicated, you need to issue it from the CA.
Issuing the Certificate
Issuing the certificate is a simple process: Expand the Certification Authority object in your MMC, expand your CA name, right-click Certificate Templates, click New, and then click Certificate Template to Issue (see Figure 6). After that, you simply locate and select your newly created and configured certificate and click OK. The new certificate appears in the right-hand pane.
)
Figure
6 Issuing the new certificate.
You're done with the Certification Authority. Now, you need to perform the final administrative step: configuring autoenrollment in Group Policy.
Configuring Autoenrollment
To deploy smartcard certificates in Windows 2000, you had to set up a smartcard enrollment station (a computer with a smartcard reader) and assign at least one person to put the certificates on the smartcards. To perform this job, the person had to physically insert the smartcard, download the certificate, maybe set the PIN, and then pull out the smartcard, repeating that process for each smartcard user. Although you may know someone who is just perfect for that job, this is a real problem for some organizations.
Although you can still set up an enrollment station and enrollment user in Windows Server 2003, you also have the option to distribute the workload of certificate deployment. This option, called autoenrollment, automates the deployment of certificates to the users' smartcards.
You can activate autoenrollment through Group Policy. Let's assume that you want to deploy smartcards to every user on your domain. Using that assumption, we'll configure the Default Domain Policy to enable autoenrollment.
Probably the quickest way to get to that Default Domain Policy is to right-click the domain object in Active Directory Users and Computers, click Properties, click Group Policy, and then click the Edit button (while the Default Domain Policy is selected). Navigate to the location shown in Figure 7. Find Autoenrollment in the right-hand pane and then click Properties.
)
Figure
7 Configuring autoenrollment.
The Autoenrollment Settings Properties dialog box appears. Configure it as shown in Figure 8—select both check boxes, or you're headed for disappointment.
)
Figure
8 Specifying the autoenrollment settings.
Click OK and then close your Group Policy window. That's all for the configuration. Now you need to know what's about to happen to the users.
What the User Sees
You'll probably have to send out distribution email or some other communication to your network users, explaining the use of smartcards and describing the enrollment process. Essentially, it goes like this:
In the user's Welcome to Windows logon dialog box, the user should see the words "Insert your card or press Ctrl-Alt-Del to logon." This prompt is merely an indication that the smartcard driver and hardware were installed.
Sometime after the user logs on by the standard process of entering a username and password, a certificate icon appears in the user's system tray. The user must click the certificate icon, which opens a Certificate Enrollment dialog box, as shown in Figure 9. The user should click the Start button in this dialog box.
)
Figure
9 Beginning the certificate enrollment process.
If you have multiple types of smartcards on your network and you selected multiple CSPs, users should be prompted to insert smartcards of all types (as many as you have). Each user must cancel enrollment requests for all smartcard types he doesn't have, and start enrollment only for the type of smartcard he has.
The user is then prompted to insert the smartcard and enter the PIN for the card. Most smartcards come with a default PIN, but you should remind users to change the default PIN during autoenrollment if that option is available, as it is for most smartcard readers (see Figure 10).
)
Figure
10 Confirming the smartcard PIN.
NOTE
Check your smartcard manufacturer's documentation concerning PIN entry rules. If I enter the PIN incorrectly three times in a row on my smartcard, Schlumberger tells me that the card will be unusable. Now there's a failsafe for you!
After the user enters the default PIN and changes it to a new PIN, the certificate is automatically downloaded to the card. This step completes the process of distributing smartcards.