Design the right PKI architecture - You will learn how to choose a single-tier or multi-tier model, separate Root CA and Issuing CA roles, and plan a trusted certificate infrastructure that fits your organization.
Deploy AD CS on your own - You will go through AD CS installation and configuration on Windows Server 2022/2025, so you can launch your first CA, choose the proper CA type, and set critical parameters.
Build a secure CA hierarchy - You will learn how to implement an offline Root CA and Issuing CA, correctly sign subordinate CA certificates, and publish them so the full hierarchy stays secure and reliable.
Configure CRL, CDP, AIA and OCSP - You will learn to publish CRLs and Delta CRLs, configure CDP and AIA locations, and deploy Online Responder so systems can validate certificate status quickly and correctly.
Create practical certificate templates - You will master creating and modifying certificate templates, setting permissions, extensions, and autoenrollment, so you can issue certificates to users, servers, and devices.
Implement Smart Card authentication - You will see how to prepare the environment for smart card logon, configure the right templates, and integrate user certificates with Active Directory and Kerberos.
Manage the certificate lifecycle - You will learn how to monitor CA operations, revoke certificates, review logs, automate tasks with PowerShell, and keep your PKI environment under control in daily administration.
Prepare CA recovery and backup - You will learn key archival, KRA configuration, backup of the CA database and private keys, and full CA recovery procedures after a failure, incident, or incorrect change.
Cryptography fundamentals provide the basis for understanding how PKI operates in Microsoft environments. Participants review symmetric and asymmetric encryption, key pairs, hashing, digital signatures, certificate structure, X.509, trust chains, and the role of certification authorities, then map these concepts to AD CS components and services.
In an organizational setting, PKI design has to align trust, operations, and security boundaries. This section compares PKI topologies, including single-tier and multi-tier models, then addresses CP and CPS planning, naming, keys and algorithms, as well as private key protection, HSM usage, and separation of administrative roles.
AD CS deployment begins with preparing the server environment and meeting system requirements for the first certification authority. Participants install the role, distinguish Enterprise, Standalone, Root, and Subordinate CA types, and configure the certificate database, cryptographic settings, and certificate validity periods.
Building a multi-tier CA structure starts with the trust hierarchy and its security model. The section walks through an offline Root CA and an Issuing CA, including parent certificate generation, subordinate CA requests and signing, certificate publication, plus integration with Active Directory, autoenrollment, and certificate policy handling.
Revocation data must be published in a way that clients can reliably reach and validate. The material covers how CRL works, how lists are published, how distribution points are configured, and where Delta CRL fits in relation to full CRL, including refresh schedules and CDP/AIA settings.
When certificate status must be checked quickly, OCSP becomes a practical alternative to CRL lookups. This part explains the OCSP validation model, the benefits over CRL, installation of the Online Responder role, integration with the CA, response signing, and options for high availability.
Certificate templates determine what can be issued, to whom, and under what rules. Participants examine template versions and certificate extensions, learn how to modify existing templates or create new ones, and compare manual enrollment with autoenrollment while managing the certificate lifecycle.
Certificate-based authentication is presented here from the user access perspective. The section explains user certificates and Kerberos logon with certificates, then covers Smart Card Logon requirements, template settings, card reader configuration, certificate issuance, and integration with Active Directory for MFA scenarios.
Daily operation of AD CS depends on disciplined certificate administration and visibility into CA activity. Participants work with issued certificates, revocation, and monitoring, then examine PKI auditing, security log analysis, and PowerShell-based automation for recurring tasks such as certificate renewal.
Key Archival and KRA configuration define how private keys can be retained and recovered under controlled conditions. The section covers certificate recovery procedures, required security controls, and CA backup and restore operations, including protection of the certificate database, private keys, and disaster recovery planning.
Securing a PKI requires decisions that go beyond installation. This section focuses on protecting the Root CA and private keys, hardening certification authorities through network segmentation and security policies, and recognizing common implementation failures such as CRL issues, misconfigured templates, and flawed CA architecture.
Hands-on work ties the full PKI stack together by building it from the ground up. Participants install Root CA and Issuing CA, configure CRL distribution points and an OCSP responder, then deploy user and device certificates with autoenrollment and Smart Card Logon. The labs conclude with CA failure simulation, backup, and full infrastructure recovery.
Windows Server basics - You should be comfortable navigating Windows Server, understand server roles and features, and be able to perform basic server and administrative service configuration.
Active Directory knowledge - You should understand how an Active Directory domain, OUs, GPOs, and service accounts work, because the course covers CA integration and certificate autoenrollment.
Networking and DNS basics - You should know TCP/IP, DNS, and network addressing basics so you can understand CDP and AIA publishing, OCSP operation, and communication between servers and clients.
Cryptography basics - You should understand public and private keys, digital signatures, and certificates so you can work more effectively with templates, CAs, and revocation mechanisms.
