Windows Server 2003 PKI and Role-Based Administration

Applies To: Windows Server 2003 with SP1

Windows 2000 Server CA administration is changed significantly with Windows Server 2003 CA role-based administration. Windows 2000 Server administrators can perform any activity on a Windows 2000 Server CA, but once CA roles are assigned on a Windows Server 2003 CA, its administrators are subject to its roles. Administrators who could perform all tasks on a Windows 2000 Server CA will only be able to perform the tasks associated with their role on the Windows Server 2003 CA. After upgrading a Windows 2000 Server CA to a Windows Server 2003 CA, its administrators need to be assigned to the roles defined in the role-based administration for the Windows Server 2003 CA.

Windows Server 2003 was designed with the needs of organizations in mind to provide role-based administration of a public key infrastructure. Windows Server 2003 certification authorities were also designed to meet the role definitions defined in version 1.0 of Certificate Issuing and Management Components Family of Protection Profiles found at https://go.microsoft.com/fwlink/?LinkId=59668

Role-based administration can be used to organize CA Administrators into separate, predefined task-based roles, each with its own set of tasks. Roles are assigned using each user's security settings. Roles are assigned to a user by assigning that user the specific security settings that are associated with the role. A user who has one type of permission, such as Manage CA permission, may perform specific CA tasks that a user with another type of permission, such as Issue and Manage Certificates permission, may not perform. Role-based administration is supported by both Windows Server 2003 enterprise and stand-alone certification authorities.

Role-based administration involves CA roles users and groups. To assign a role to a user or group, you must assign the role's corresponding security permissions, group memberships, or user rights to the user or group. These security permissions, group memberships, and user rights are used to distinguish which users have which roles. The following table describes the CA roles of role-based administration and the groups relevant to role-based administration.

With the default installation, all CA roles are assigned and modified by local Administrators on the computer, Enterprise Admins and Domain Admins (if joined to a domain). Local Administrators, Enterprise Admins and Domain Admins are CA Administrators by default on an Enterprise CA. Only local Administrators are CA Administrators by default on a stand-alone CA. If the stand-alone CA is joined to an Active Directory domain, Domain Admins are also CA Administrators.

The CA Administrator and Certificate Manager roles can be assigned to either Active Directory users or local users in the local Security Accounts Manager (SAM) database. As a best practice, it is recommended to assign roles to group accounts instead of individual user accounts. Only CA Administrator, Certificate Manager (as Officer in the CIMC), Auditor (as Auditor in the CIMC), and Backup Operator (as Operator in the CIMC) are CA roles. The other users described in the following table are relevant to role-based administration and should be understood before assigning CA roles.

Only CA Administrators and Certificate Managers are assigned using the Certification Authority Microsoft Management Console (MMC) snap-in. Other roles, users, and groups are specified in their related consoles. To change the roles of a user, you must change the user's security permissions, group membership, or user rights.

When key archival is configured on an enterprise CA running Windows Server 2003 Enterprise Edition, the subject obtaining a certificate from a CA will provide their private key to the CA. The CA stores that private key in its database until key recovery is desired. Only a Certificate Manager can get the encrypted private key blob out of the CA database, which is then passed on to key recovery agents (KRAs). For more information, see the Key Archival and Management in Windows Server 2003 white paper.

Roles and Activities

Each CA role has a specific list of CA administration tasks associated with it. The following table lists all the CA administration tasks along with the roles in which they are performed. One of the most important distinctions is the local Administrator versus CA Administrator role. The local Administrator applies to the local operating system privilege which may be required to perform some tasks associated with the operations of the CA. The CA Administrator role applies only to specific tasks within the functionality of the CA. The local Administrator will always have full control of the system including the CA and cannot be blocked from taking control of the CA. Therefore, it is very important to keep this fact in mind when assigning operational and delegated roles to the CA for management purposes.

Assigning Roles

The CA Administrator for a CA assigns users to the separate roles of role-based administration by giving each user the security settings required by a role. The CA Administrator can assign a user to more than one role, but the CA is more secure when each user belongs to one role only. When each CA role belongs to one user only, fewer CA tasks can be compromised if a user's account becomes compromised.

The default installation setting for a stand-alone CA is to have members of the local Administrators security group as CA Administrators. The default installation setting for an Enterprise CA is to have local Administrators, Enterprise Administrators, and Domain Administrators as CA Administrators. To limit the power of any of these accounts, they should be removed from the CA Administrator and Certificate Manager roles once all CA roles are assigned; and they should also be removed from the Administrators group on the CA computer if it is not a Domain Controller. To list the roles a current user holds with a given CA, see the sample script in Appendix A.

Best Practice As a best practice, group accounts that have been assigned CA Administrator or Certificate Manager roles should not be members of the local Admin security group. Also, CA roles should only be assigned to group accounts and not individual user accounts.