Export (0) Print
Expand All
3 out of 4 rated this helpful - Rate this topic

Install the HRA Role Service

Updated: February 29, 2012

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2

The Health Registration Authority (HRA) server is a NAP enforcement server for the IPsec enforcement method and the no enforcement method. To deploy an HRA server for NAP, you must install the HRA role service. For more information about HRA, see IPsec Enforcement Configuration.

noteNote
Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).

PowerShell Logo This topic includes sample Windows PowerShell cmdlets that you can use to automate some of the procedures described. For more information, see How to Run a Windows PowerShell Cmdlet.

  1. Open a Windows PowerShell session with elevated rights. To do this, right-click the Windows PowerShell or Command Prompt Start menu object that you are using to start your Windows PowerShell sessions, and then click Run as administrator.

    noteNote
    Because of security restrictions imposed by User Account Control, you must use a Windows PowerShell session with elevated rights when adding server roles and role services.

  2. Load the Server Manager module into the Windows PowerShell session before working with Server Manager cmdlets. Type the following, and then press Enter.

    Import-Module Servermanager
    
    noteNote
    Windows PowerShell cmdlets are not case-sensitive.

  3. Type the following to install the HRA role service:

    Install-windowsfeature -name NPAS-Health -IncludeManagementTools 
    
    
    noteNote
    The –IncludeManagementTools parameter installs the management console on the target server.

  4. Verify via the Windows PowerShell console that the installation succeeded. Under Success, the result should be True.

  1. In Server Manager, click Manage and click Add Roles and Features.

  2. On the Before you begin page, click Next.

  3. On the Select installation type page, click Role/Feature Based Install and then click Next.

  4. On the Select destination server page, click Select a server from the server pool, click the names of the servers where you want to install NPS and then click Next.

  5. On the Select server roles page, click Network Policy and Access Services, and then click Next three times.

    noteNote
    If the Network Policy Server role service is already installed, expand the NPAS node and select Health Registration Authority. Click Next three times and continue with step 7 below.

  6. On the Select role services page, click Health Registration Authority, and in the Add Roles and Features Wizard dialog box, verify that Include management tools (if applicable) is selected, click Add Features, and then click Next.

    noteNote
    If not already installed, the Network Policy Services role service is automatically installed with HRA.

  7. On the Certification Authority page, select one of the following based on your deployment, and then click Next.

    • If you want to install a NAP certification authority (CA) now on the local computer, choose Use the local CA to issue health certificates for this HRA server.

    • If you have already installed Active Directory Certificate Services (AD CS) on this computer and you will use it as a NAP CA, choose Use the local CA to issue health certificates for this HRA server.

    • If you have already installed a NAP CA on another computer, choose Use an existing remote CA.

    • If you will install a NAP CA later on this computer or another computer, choose Select a CA later using the HRA console.

    noteNote
    This procedure assumes a choice of Select a CA later using the HRA console. For more information about installing a NAP CA for use with HRA, see Deploying NAP Certification Authorities.

  8. On the Authentication Requirements page, select one of the following based on your deployment, and then click Next.

    • If this HRA will supply health certificates to domain member computers only, choose Yes, require requestors to be authenticated as members of a domain.

    • If this HRA will supply health certificates to non-domain member computers, choose No, allow anonymous requests for health certificates.

  9. On the Server Authentication Certificate page, select one of the following based on your deployment, and then click Next.

    • If you have already installed a certificate for Secure Sockets Layer (SSL) encryption on this server, choose Choose an existing certificate for SSL encryption.

    • If you will not use SSL with HRA, or if you will provision an SSL certificate later, choose Don't use SSL or choose a certificate for SSL encryption later.

    noteNote
    This procedure assumes a choice of Choose an existing certificate for SSL encryption. For more information about installing an SSL certificate for use with HRA, see Configure an SSL Certificate for HRA.

  10. Under Choose an existing certificate for SSL encryption, click the certificate that you will use for SSL encryption, and then click Properties.

  11. In the Certificate window, click the Details tab. Verify the following values, and then click OK.

    • The Issuer field has a value corresponding to a trusted CA in your domain.

    • The Valid to field has a value greater than the current date.

    • The Subject field has a value equal to the fully qualified domain name (FQDN) of the HRA server.

    • The Enhanced Key Usage field has a value that includes Server Authentication (1.3.6.1.5.5.7.3.1).

  12. Click Next three times, and then click Install.

  13. On the Results page, verify that all roles and features were installed successfully, and then click Close.

  1. In Server Manager, under Roles Summary, click Add Roles, and then click Next.

  2. On the Select Server Roles page, select the Network Policy and Access Services check box, and then click Next twice.

  3. On the Select Role Services page, select the Health Registration Authority check box. If you are prompted to install additional role services and features, click Add Required Role Services, and then click Next.

  4. On the Choose the Certification Authority to use with the Health Registration Authority page, select one of the following based on your deployment, and then click Next.

    • If you want to install a NAP certification authority (CA) now on the local computer, choose Install a local CA to issue health certificates for this HRA server.

    • If you have already installed Active Directory Certificate Services (AD CS) on this computer and you will use it as a NAP CA, choose Use the local CA to issue health certificates for this HRA server.

    • If you have already installed a NAP CA on another computer, choose Use an existing remote CA.

    • If you will install a NAP CA later on this computer or another computer, choose Select a CA later using the HRA console.

    noteNote
    This procedure assumes a choice of Select a CA later using the HRA console. For more information about installing a NAP CA for use with HRA, see Deploying NAP Certification Authorities.

  5. On the Choose Authentication Requirements for the Heatlh Registration Authority page, select one of the following based on your deployment, and then click Next.

    • If this HRA will supply health certificates to domain member computers only, choose Yes, require requestors to be authenticated as members of a domain.

    • If this HRA will supply health certificates to non-domain member computers, choose No, allow anonymous requests for health certificates.

  6. On the Choose a Server Authentication Certificate for SSL Encryption page, select one of the following based on your deployment, and then click Next.

    • If you have already installed a certificate for Secure Sockets Layer (SSL) encryption on this server, choose Choose an existing certificate for SSL encryption.

    • If you want to create a self-signed certificate for SSL encryption, choose Create a self-signed certificate for SSL encryption.

    • If you will not use SSL with HRA, or if you will provision an SSL certificate later, choose Don't use SSL or choose a certificate for SSL encryption later.

    noteNote
    This procedure assumes a choice of Choose a Server Authentication Certificate for SSL Encryption. For more information about installing an SSL certificate for use with HRA, see Configure an SSL Certificate for HRA.

  7. Under Choose a Server Authentication Certificate for SSL Encryption, click the certificate that you will use for SSL encryption, and then click Properties.

  8. In the Certificate window, click the Details tab. Verify the following values, and then click OK.

    • The Issuer field has a value corresponding to a trusted CA in your domain.

    • The Valid to field has a value greater than the current date.

    • The Subject field has a value equal to the fully qualified domain name (FQDN) of the HRA server.

    • The Enhanced Key Usage field has a value that includes Server Authentication (1.3.6.1.5.5.7.3.1).

  9. Click Next three times, and then click Install.

  10. On the Installation Results page, verify that all roles and features were installed successfully, and then click Close.

Did you find this helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft. All rights reserved.