Active Administrator 8.6 - User Guide

Adding a forest

Adding a forest

Active Administrator® manages all Certificate Authority (CA) certificates in a forest.

To add a forest

1	Select Certificate | Certificate Authority.

2	Click Add Forest.

3	The CA management for the forest is enabled by default.

 

NOTE: Once you add a forest, you can disable the forest to remove it temporarily from CA management. Click Edit forest and clear the check box. To remove the forest permanently, click Remove forest.

4	Search caching is enabled by default. If enabled, Active Administrator searches the cache based on the configuration selected in Configuration | Certificate Authority. See Configuring certification authority.

 

NOTE: The search caching feature must be enabled in Configuration | Certificate Authority.

To override the cache setting and always search Active Directory for this forest, clear the check box.

5	Set the maximum number of events in hours to return in the search results. The default value is 48 hours of events.

6	By default, server backup is enabled for the forest. Enter the password for the account used to perform the backup. To disable backups, clear the check box.

7	By default the Active Administrator Foundation service (AFS) account is used to access the forest. To use a different account, select Specify account and enter the user name and password for the account.

NOTE: The specified account must have the rights to read the server configuration settings from the registry and to run backups.

8

Click OK.

Searching Certificate Authority

Searching Certificate Authority

The Active Administrator® Certificate Authority Search feature finds users and computers that have certificates issued by Active Directory® Certificate Authority and published into Active Directory. From the search results, you can view certificate details.

To search certificate authority

1	Select Certificate | Certificate Authority.

2	Select a forest from the list in the tool bar. If you do not see a forest, click Add forest. See Adding a forest.

3	Open the Search tab.

4	Select a search type.

 

Search type	Description
User	Search for users who have certificates issued by Active Directory Certificate Authority.
Computer	Search for computers that have certificates issued by Active Directory Certificate Authority.
Templates	Search the Template field of certificates issued by Active Directory Certificate Authority for both users and computers.
Issuer	Search the Issuer field of certificates issued by Active Directory Certificate Authority for both users and computers.
Key Usage	Search the Key Usage field of certificates issued by Active Directory Certificate Authority for both users and computers.
Objects without certificates	Search for all users or computers that do not have certificates issued by Active Directory Certificate Authority.

5	By default, the cache is searched. To search Active Directory, clear the Use search cache check box.

NOTE: The search cache is not available when the Objects without certificates search type is selected. To configure the search cache, see Configuring certification authority.

6	Select the domain to search. Searching All Domains is the default.

7	Select a filter from the list.

8	Depending on which search type you chose, browse to locate the user, computer, template, issuer, or key usage to search.

If you selected the Objects without certificates search type, select either users or computers to search.

9	Click Search.

The search results display the number of certificates found.

10	Double-click a result to view the certificates. Select a certificate, and click View Certificate to see details and to install the certificate.

Managing Certificate Authority servers

Managing Certificate Authority servers

You can view and manage each Certificate Authority server found in the selected forest. In this tab, you can stop, start, and restart the Active Directory Certificate service (certsvc), back up the selected server, and open the Microsoft Management Console (MMC) for the selected server.

To manage a Certificate Authority server

1	Select Certificate | Certificate Authority.

2	Select a forest from the list in the tool bar. If you do not see a forest, click Add forest. See Adding a forest.

3	Open the Servers tab.

▪	For each server, you can Start/Stop/Restart the Active Directory Certificate Service.

▪	To open the Microsoft Management Console (MMC) for a server, click Manage.

▪	To back up the selected server, click Backup. See Viewing Certificate Authority backups.

Viewing certificate templates

Viewing certificate templates

You can view all the certificate templates found in the selected forest.

To view certificate templates

1	Select Certificate | Certificate Authority.

2	Select a forest from the list in the tool bar. If you do not see a forest, click Add forest. See Adding a forest.

3	Open the Templates tab.

▪	To view details, double-click a template.

▪	To search for templates, start typing in the Search template names box. The list filters as you type.

▪	To sort the templates, click in a column header.