Export (0) Print
Expand All

Configure NAP CA Properties

Updated: February 29, 2012

Applies To: Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2

Use the following procedures on your NAP certification authorities (CAs) to verify that these servers are correctly configured for use with Health Registration Authority (HRA) and the NAP IPsec enforcement method.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure. Review details about using the appropriate accounts and group memberships at Local and Domain Default Groups (http://go.microsoft.com/fwlink/?LinkId=83477).

Use the following procedure to verify that HRA has been granted sufficient permissions on the NAP CA and that the issuing of certificates does not require administrator approval.

CA security settings determine whether HRA has sufficient permissions to issue health certificates. Use the following procedure to verify these permissions on your NAP CAs. This procedure applies to both enterprise and standalone CA servers.

  1. On the NAP CA, click Start, click Run, type certsrv.msc, and then press ENTER.

  2. Right-click the common name for your CA, and then click Properties.

  3. Click the Security tab.

  4. If your HRA and NAP CA are running on the same computer, click Add, under Enter the object names to select, type NETWORK SERVICE, click OK, and then select Allow permissions for Issue and Manage Certificates, Manage CA, and Request Certificates.

  5. If your HRA and NAP CA are running on different computers, click Add, click Object Types, select Computers, click OK, under Enter the object names to select, type the DNS name of your HRA server, and then select Allow permissions for Issue and Manage Certificates, Manage CA, and Request Certificates.

  6. Click OK, and then close the Certification Authority console.

In order for NAP client computers to acquire health certificates immediately when they are determined to be compliant with network health requirements, NAP CAs must be configured to issue health certificates automatically. Use the following procedure to verify that certificates are issued automatically. This procedure applies to both enterprise and standalone CA servers.

  1. Click Start, click Run, type certsrv.msc, and then press ENTER.

  2. Right-click the common name of your CA, and then click Properties.

  3. Click the Policy Module tab, and then click Properties.

  4. Verify that Follow the settings in the certificate template is selected.

  5. Click OK twice, and then close the Certification Authority console.

See Also

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft