Guidelines For Using Ca Administration Roles

By Author: smileyi
Total Articles: 30
Comment this article

As an administrator, you must plan trust relationships to provide users with the access to resources they require. When you add a Windows Server 2003 domain to an existing Windows Server 2003 forest, a tree-root or a parent-child trust is established automatically. Both of these trust relationships are two-way and transitive and are established at the time that the domain is created. Once established, these trust relationships do not need to be managed.
The four remaining types of trusts must be managed. They are
Shortcut trusts
Realm trusts
External trusts
Forest trusts

You assign the CA Administrator and MCSE Certification Manager roles by giving the Security permission to the Windows group you have created for this purpose. Follow these guidelines for using CA administrative roles:
Assign these permissions to a group rather than to a user.
Remove CA-specific roles from the Administrators group.
Important The Administrators group retains the right to renew the CA certificate.
I Assign trusted users to fulfill the roles. When ...
... designing the use of CA administrative roles, remember their purpose: separation of roles and increased security of operations. IT certification The difficulty in implementing roles to fulfill these purposes is the inconvenience and the need in smaller organizations to identify sufficiently trusted individuals to perform the roles. It does no good to require role separation and then give the trusted role to someone who has not earned that trust.
I Enable role separation:
Q If you cannot enforce role separation, wherever possible, dictate that privileges be separated.
Q If role separation between the CA Manager and Certificate Manager cannot be established because of an organization's small size, MCSE separate operating system administration from CA administration.
Q Because those who have full administrator privileges on the CA computer can regain administrative control of the CA, give only highly trusted individuals this ability. Do not allow all current members of the Administrators group to have this ability.