You have a Windows Server 2008 R2 Enterprise Root certification authority (CA).
You need to grant members of the Account Operators group the ability to only manage Basic EFS
certificates.
You grant the Account Operators group the Issue and Manage Certificates permission on the CA.
Which three tasks should you perform next?
(Each correct answer presents part of the solution. Choose three.)
A.
Enable the Restrict Enrollment Agents option on the CA.
B.
Enable the Restrict Certificate Managers option on the CA.
C.
Add the Basic EFS certificate template for the Account Operators group.
D.
Grant the Account Operators group the Manage CA permission on the CA.
E.
Remove all unnecessary certificate templates thatare assigned to the Account Operators group.
Explanation:
http://technet.microsoft.com/en-us/library/cc779954%28v=ws.10%29.aspx
Role-based administration
Role explanation
Role-based administration involves CA roles, users,and groups. To assign a role to a user or group, you must
assign the role’s corresponding security permissions, group memberships, or user rights to the user orgroup.
These security permissions, group memberships, and user rights are used to distinguish which users have
which roles. The following table describes the CA roles of role-based administration and the groups relevant to
role-based administration.
..
Certificate Manager:
Delete multiple rows in database (bulk deletion)
Issue and approve certificates
Deny certificates
Revoke certificates
Reactivate certificates placed on hold
Renew certificates
Recover archived key
Read CA database
Read CA configuration information
…
http://technet.microsoft.com/en-us/library/cc753372.aspx
Restrict Certificate Managers
A certificate manager can approve certificate enrollment and revocation requests, issue certificates, and
manage certificates. This role can be configured byassigning a user or group the Issue and Manage
Certificatespermission.
When you assign this permission to a user or group,you can further refine their ability to manage certificates by
group and by certificate template. For example, youmight want to implement a restriction that they can only
approve requests or revoke smart card logon certificates for users in a certain office or organizational unit that
is the basis for a security group.
This restriction is based on a subset of the certificate templates enabled for the certification authority (CA) and
the user groups that have Enroll permissions for that certificate template from that CA.
..
To configure certificate manager restrictions for aCA:
1. Open the Certification Authority snap-in, and right-click the name of the CA.
2. Click Properties, and then click the Security tab.
3. Verify that the user or group that you have selected has Issue and Manage Certificates permission. If they
do not yet have this permission, select the Allow check box, and then click Apply.
4. Click the Certificate Managers tab.
5. Click Restrict certificate managers, and verify that the name of the group or user is displayed.
6. Under Certificate Templates, click Add, select the template for the certificates that you want this user or
group to manage, and then click OK. Repeat this step until you have selected all certificate templatesthat
you want to allow this certificate manager to manage.
7. Under Permissions, click Add, type the name of the client for whom you want the certificate manager to
manage the defined certificate types, and then click OK.
8. If you want to block the certificate manager frommanaging certificates for a specific user, computer, or
group, under Permissions, select this user, computer, or group, and click Deny.
9. When you are finished configuring certificate manager restrictions, click OK or Apply.
