AD Certificate Distribution

Transcription

1 Technical Brief AD Certificate Distribution Contents Introduction 2 Preparation 2 Server Actions 4 Active Directory Actions 5 Appendix A: Scripts zip 10

2 INTRODUCTION M86-Security provides a solution for the distribution of the Secure Web Service Hybrid (SWSH) Agent and Certificates (p12) via the organizations Active Directory Group Policy Objects (GPO). The proposed solution is a silent installation and distribution of digital certificates as a unique identifier for end-users of the M86 Secure Web Service Hybrid cloud solution. This document provides information regarding any issues associated with the installation and implementation of the stages performed during the proposed digital certification solution. Agent Installation To install the Agent, an administrator must log into the station. This is required as the agent must be installed with administrator privileges. Certificate Management Upon Secure Web Service Hybrid cloud user login to the domain, on a station in which an agent is already installed, the user will receive the unique key and certificate via the domain s GPO. It should be noted that this solution will be applied at the user s login (not when unlocked) and when the policy is refreshed (based on the set defaults of the organization). The Solution will test whether the certificate is needed, and if so, the certificate will be installed for the user. The procedures outlined below are the steps necessary to accomplish the aforementioned tasks PREPARATION 1. Download and install any file archive manager, such as WinRar ( 2. Define a dedicated file folder in the system where cloud user certificates are to be placed (for example: CertsDir). 3. Extract the cloud user certificates, as downloaded from the Policy Server GUI, into CertsDir.Ensure the certificate name format is as follows: <username>.p12 4. Extract the files found in attached to this document (Appendix A: Scripts zip) to the CertsDir 5. From the extracted files, Run the Change Permissions.bat file (The file should be run under Administrator privileges). NOTE: The.bat file changes the permissions on the certificates (.p12) files and allows each user to access only the certificate file that belongs uniquely to that user.

3 6. Edit the script variables according to the enterprise-specific environment: a. Right-click the file Install.vbs and select Edit. b. In the selected text, change the values for the following: i. SERVER The server from which the cloud users obtain their certificates. NOTE: The server pertains to the Domain Controller IP/name and not the Policy Server name. ii. PASSWORD The cloud user s certificate password as defined in the Policy Server GUI during initial policy server configurations. c. Save the file and exit. d. Right-click the file InstallAgent.vbs and select Edit e. In the selected text, change the values for the following: i. SERVER The server from which the cloud users obtain their certificates. NOTE: The server pertains to the Domain Controller IP/name and not the Policy Server name. ii. INSTALLER The Secure Web Service Agent installer file name. The installer is downloaded from the Poicy Server GUI. f. Save the file and exit.

4 SERVER ACTIONS 1. Create a folder titled "CertificatesDist". This folder can be created anywhere in the file system of the operating system. 2. Right-click the "CertificatesDist" folder and select Sharing and Security. 3. Enable the Share this folder radio button and set the share name as CertificatesDist. 4. Move all the files previously created in steps 1 through 6 in the Preparation section above, as well as the certificate files, to the "CertificatesDist" folder.

5 ACTIVE DIRECTORY ACTIONS 1. Open the Active Directory Users and Computers Management Screen. 2. Navigate to the Start menu, select Run. 3. Enter line: dsa.msc and click OK. The Active Directory Users and Computers screen will open: 4. In the left tree pane, select the Domain, right-click and choose properties.

6 5. In the Domain Properties window, in the Group Policy tab, create the required Group Policy Object: a. Click New. b. Change the name of the Group Policy Object as required. For example: Certificates-Distribution. c. Click Edit. d. In the open Group Policy Object Editor window, navigate to Windows Settings. e. Select Scripts (Logon /Logoff) and double-click Logon. f. Click Add.

7 g. Under Script Name, register the full path of the share folder where the script Install.vbs is saved, and click OK. The path should be, for example, \\<SERVERNAME>\CertificatesDist\install.vbs WARNING! Do not choose the path via Browse! Enter the path manually.

8

9 h. Click Add once more. i. Under Script Name, enter the full path of the share folder where the script InstallAgent.vbs is saved and click OK. WARNING! Do not choose the path via Browse! Enter the path manually. j. In the windows Logon Properties click OK. k. Close the Group Policy Object Editor window. 6. In the Properties window (Domain), click Close. 7. Close Active Directory Users and Computers. 8. Click Start, select Run, and enter gpupdate /force in the text box. 9. Click OK.

10 APPENDIX A: SCRIPTS ZIP ABOUT M86 SECURITY M86 Security is a global provider of Web and messaging security products, delivering comprehensive protection to more than 20,000 customers and over 16 million users worldwide. Asom malware and spam; protect their sensitive information; and maintain employee productivity. The company is based in Orange, California with international headquarters in London and offices worldwide. For more information about M86 Security, please visit