This is a quick list of the groups associated with Active Directory Certificate Services.
CERTSVC_DCOM_ACCESS
Purpose: Grant DCOM access to Certificate Authority.
Default description: This group has no default description.
Group type: Local/Domain Local Security group.
Default members: Everyone/Domain Users and Domain Computers.
This group is created when Windows Server 2003 Service Pack 1 is installed on a Certificate Authority. If the CA is a member server (or in a workgroup); CERTSVC_DCOM_ACCESS is a computer local group, if the CA is a DC; CERTSVC_DCOM_ACCESS is a domain local group. Also when you install a Certificate Authority (CA) on a Windows Server 2003 machine that already has Service Pack 1 (or later); this group is created.
All security principals that need to enroll certificates from the CA must be a member, direct or indirect, of this group. If the CA is a member server; the Everyone security group is added to CERTSVC_DCOM_ACCESS. If the CA is a DC; the Domain Users and Domain Computers groups are added to CERTSVC_DCOM_ACCESS.
Only domains with a CA installed on a DC have this group, and only members servers with a CA have it as a computer local group. If you have several domains in your forest, only computers and users in the domain where the CA resides can request certificates. If other domains in the forest need to enroll certificates, security principals from those domains must be added to the group.
In Windows Server 2008 this group was replaced by the Certificate Service DCOM Access group (see own group into below).
More info:
Description of the changes to DCOM security settings after you install Windows Server 2003 Service Pack 1
Error message when a client computer requests a certificate from a computer that is running Windows Server 2003 with Service Pack 1: “The wizard cannot be started because of one or more of the following conditions”
Certificate Service DCOM Access
Purpose: Grant DCOM access to Certificate Authority.
Default description: Members of this group are allowed to connect to Certification Authorities in the enterprise.
Group type: Builtin Local Security Group.
Default members: Authenticated Users.
This group serves the same purpose as CERTSVC_DCOM_ACCESS, but is created in Windows Server 2008 domains. It grants access to Certificate Authorities, but is a Builtin local group as opposed to CERTSVC_DCOM_ACCESS, which is a Local or Domain Local group.
Sometimes you will se both CERTSVC_DCOM_ACCESS and Certificate Service DCOM Access in a domain.
Cert Publishers
Purpose: Publish certificates to Active Directory.
Default description: Enterprise certification and renewal agents
Group Type: Global Security Group (Windows 2000)/Domain Local Security Group (Windows Server 2003 or later)
Default members: Certificate Authority computer account from same domain as group.
This group is created when an Active Directory domain is created. In Windows 2000 it is created as a Global Security Group, but in Windows Server 2003 or later it is created as a Domain Local Security Group.
If a Windows 2000 domain is upgraded to Windows Server 2003 or later, this group remains as a Global Security Group; it is not automatically updated to Domain Local scope. To change the group scope you can run this command:
dsmod group CN=Cert Publishers,CN=Users,<domain DN> -scope l
Sometimes you cannot change the group scope directly to Domain Local. In this case, you have to run 2 commands:
dsmod group CN=Cert Publishers,CN=Users,<domain DN> -scope u
(This command changes the global group into a universal group.)
dsmod group CN=Cert Publishers,CN=Users,<domain DN> -scope l
(This changes the group scope to Domain Local.)
This group is granted Read userCertificate and Write userCertificate on all user and computer accounts in the domain where it resides. If the same domain contains a Certificate Authority the CA is added to this group, thus allowing it to publish certificates to the user or computer.
The permissions granted to the Cert Publishers group in a domain are defined on the AdminSDHolder container located in <domain>/System. Changing the Cert Publishers group’s permissions on AdminSDHolder will change the permissions that Cert Publishers have on all objects in the domain.
In a multi-domain forest, the CA computer account(s) must be added to this group in all the domains where you want the CA to be able to publish certificates.
If you have a multi-domain forest the PowerShell script below will display the group scope and members of all the Cert Publishers groups in the forest:
#
# EnumerateAllCertPublishersMembers2.ps1
# by Morgan Simonsen, Atea
#
# List the group type, scope and members of the Cert Publishers group
# in every domain in a forest.
#
# More info:
# http://morgansimonsen.wordpress.com/2012/01/24/an-overview-of-groups-used-by-active-directory-certificate-services/
#
$colCertPublishersGroups = @()
$forest = [System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()
Write-Host “Getting forest-wide membership of Cert Publishers groups…”
# Get members of ‘Cert Publishers’ for forest-root domain
$objTemp = New-Object System.Object
$objTemp | Add-Member -type NoteProperty -name “Domain” -value $forest.name
$group = Get-QADGroup -Identity ( $forest.name + “/users/Cert Publishers” ) -Service $forest.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Group Name” -value $group.name
$objTemp | Add-Member -type NoteProperty -name “Group Type” -value $group.grouptype
$objTemp | Add-Member -type NoteProperty -name “Group Scope” -value $group.groupscope
$members = Get-QADGroupMember -Identity ( $forest.name + “/users/Cert Publishers” ) -Service $forest.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Members” -value $members
If ( $members -ne $null )
{
ForEach ( $member in $members )
{
#Nothing
}
}
$colCertPublishersGroups += $objTemp
$domain = $null
$group = $null
$members = $null
$objTemp = $null
# Get members of ‘Cert Publishers’ for child domains
$forest.children | ForEach `
{
$objTemp = New-Object System.Object
$mydomain = Get-QADObject -Identity $_.name #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Domain” -value $mydomain.name
$group = Get-QADGroup -Identity ( $_.name + “/users/Cert Publishers” ) -Service $_.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Group Name” -value $group.name
$objTemp | Add-Member -type NoteProperty -name “Group Type” -value $group.grouptype
$objTemp | Add-Member -type NoteProperty -name “Group Scope” -value $group.groupscope
$members = Get-QADGroupMember -Identity ( $_.name + “/users/Cert Publishers” ) -Service $_.pdcroleowner #-ea silentlycontinue
$objTemp | Add-Member -type NoteProperty -name “Members” -value $members
If ( $members -ne $null )
{
ForEach ( $member in $members )
{
#Nothing
}
}
$colCertPublishersGroups += $objTemp
$domain = $null
$group = $null
$members = $null
$objTemp = $null
}
$colCertPublishersGroups
More info:
Certification Authority configuration to publish certificates in Active Directory of trusted domain
Cert Publishers scope changed from Global to Domain Local in Windows Server 2003
Enterprise CA May Not Publish Certificates from Child Domain or Trusted Domain
