Microsoft RPC/DCOM
Last updated
Was this helpful?
Last updated
Was this helpful?
The Microsoft Active Directory Certificate Services (ADCS), sometimes only called "Microsoft CA", is the Certification Authority software built into Windows Server. The software was originally developed at the end of the last millenium and continued to receive some additions for the next ten to fifteen years.
An alternative is Microsoft's SOAP or , which Microsoft calls Web Enrollment and NDES, respectively.
We have no knowledge of other CA systems implementing this protocol, although Microsoft has published in the meantime. On the client-side, Windows has built-in support of the protocol, other platforms are not supported.
Its main enrollment method is a proprietary protocol based on RPC or DCOM.
Autoenrollment also uses this protocol. For autoenrollment to work, you need
a domain-joined device.
Group policy enables autoenrollment,
an Enterprise CA (as opposed to stand-alone)
that enrolls a Certificate Template for which
the user or device has the enrollment and autoenrollment permissions.
The default interval to check for autoenrollments is 8 hours, although it can be enforced with certutil -pulse or often better gpupdate -force.
This protocol uses the authentication protocols built into Active Directory, i.e. users and computers authenticate with their AD credentials.