How to Install AD CS on Windows Server 2025 (Step-by-Step PKI Setup) скачать в хорошем качестве

How to Install AD CS on Windows Server 2025 (Step-by-Step PKI Setup)

In this video, you’ll learn how to install and configure Active Directory Certificate Services (AD CS) on Windows Server 2025 step by step. This complete tutorial covers: ✅ Installing the AD CS role ✅ Configuring Certificate Authority (Root CA) ✅ Setting up PKI on Windows Server 2025 ✅ Choosing CA types (Enterprise vs Standalone) ✅ Certificate templates overview ✅ Best practices & security tips ✅ Common AD CS mistakes to avoid Hello everyone, I hope you’re all doing well, and welcome back to SANTECH, your go-to channel for Windows Server and IT infrastructure tutorials. In this video, we’re going to learn how to install and configure Active Directory Certificate Services, also known as AD CS, on Windows Server 2025. Active Directory Certificate Services is a Windows Server role that allows organizations to build a public key infrastructure, issue digital certificates, and secure services like HTTPS, VPN, and authentication. By the end of this video, you’ll have a fully functional Certificate Authority set up in your environment. 🧰 Prerequisites Before we begin, let’s quickly review the requirements for installing AD CS: A Windows Server 2025 machine joined to your domain. A domain admin or enterprise admin account. A properly configured Active Directory Domain Services environment. A static IP address configured on the server. And finally, the server’s hostname and time synchronized with the domain controller. In my lab environment, I already have a domain named santech.local. The domain controller is up and running, and we have a member server ready where we’ll install Active Directory Certificate Services. 🖥️ Step 1: Adding the AD CS Role Let’s begin on the Windows Server 2025 machine. Open Server Manager. Click on Manage and select Add Roles and Features. In the wizard, click Next until you reach the Server Roles page. Check Active Directory Certificate Services, then click Add Features when prompted. Click Next through the Features page. On the AD CS page, you’ll see a brief description of the service. Click Next. On the Role Services page, select Certification Authority. You can also select additional components like Web Enrollment if needed. Click Next and then Install. Wait for the installation to complete. Once it’s finished, click on Configure Active Directory Certificate Services on the destination server. ⚙️ Step 2: Configuring the Certification Authority On the AD CS Configuration Wizard, click Next. Under Credentials, make sure you’re logged in with a domain admin account. On the Role Services page, select Certification Authority and click Next. Choose Enterprise CA because this server is part of an Active Directory domain. Next, choose Root CA as this will be our first CA in the environment. If you already have a root CA, you can also set this up as a subordinate CA, but in this lab we will go with a root CA. 🔐 Step 3: Creating a New Private Key Select Create a new private key and click Next. You can keep the default cryptographic options or adjust them to your security policy. For most environments, the default settings are sufficient. Click Next. 📜 Step 4: Setting the CA Name and Validity Period On the CA Name page, the common name is filled automatically based on the server name. You can change it if needed. Click Next. On the Validity Period page, specify how long the root CA certificate will be valid. For lab environments, 5 years is common. In production, you may want a longer period. Click Next. 💾 Step 5: Completing the Installation Specify the location for the certificate database and log files. The default location works fine for most setups. Click Next. On the Confirmation page, review your selections and click Configure. After a few seconds, the configuration will complete successfully. Click Close. 🌐 Step 6: Verifying the CA Installation To verify that the CA is installed correctly: Open Server Manager, click on Tools, and select Certification Authority. Expand your server name. You should see the CA running with no errors. Right click the server name and select Properties to view the certificate details. From a domain client, you can also open the Certificates MMC to confirm that the root certificate has been published to Active Directory. At this point, your enterprise root CA is fully functional. 🧭 Optional: Web Enrollment If you want to allow users to request certificates through a browser: Re-open the Add Roles and Features Wizard. Add the Certification Authority Web Enrollment role service. Install the required IIS components. Once installed, you can access the enrollment portal at: http://servername/certsrv This is optional but useful in environments where users or devices need to request certificates manually.