The xAdcsDeployment module is a part of the Windows PowerShell Desired State Configuration (DSC) Resource Kit, which is a collection of DSC Resources produced by the PowerShell Team. This module contains the resources xAdcsCertificationAuthority and xAdcsWebEnrollment. The xAdcsDeployment module can be used to configure Certificate Services after the role is enabled on a Windows Server.
All of the resources in the DSC Resource Kit are provided AS IS, and are not supported through any Microsoft standard support program or service. The "x" in xAdcsDeployment stands for experimental, which means that these resources will be fix forward and monitored by the module owner(s).
Please leave comments, feature requests, and bug reports in the Q & A tab for this module.
If you would like to modify xAdcsDeployment module, feel free. When modifying, please update the module name, resource friendly name, and MOF class name (instructions below). As specified in the license, you may copy or modify this resource as long as they are used on the Windows Platform.
For more information about Windows PowerShell Desired State Configuration, check out the blog posts on the PowerShell Blog (this is a good starting point). There are also great community resources, such as PowerShell.org , or PowerShell Magazine . For more information on the DSC Resource Kit, check out this blog post.
To install xAdcsDeployment module
To confirm installation:
This module requires the latest version of PowerShell (v4.0, which ships in Windows 8.1 or Windows Server 2012R2). To easily use PowerShell 4.0 on older operating systems, install WMF 4.0. Please read the installation instructions that are present on both the download page and the release notes for WMF 4.0.
The xAdcsDeployment provides two resources, xAdcsCertificationAuthority and xAdcsWebEnrollment. The module has been specifically tested as a method to populate a Certificate Services server role on Windows Server 2012 R2 after the Certificate Services role and the Web Enrollment feature have been enabled. Active Directory Certificate Services (AD CS) is used to create certification authorities and related role services that allow you to issue and manage certificates used in a variety of applications.
Certificates are widely used to establish trust relationships between computers. This DSC resource can be used to address some of the most common scenarios including the need for a Stand-Alone Certificate Authority or an Active Directory Trusted Root Certificate Authority and the Certificate Services website for users to submit and complete certificate requests.
In a specific example, when building out a web server workload such as an internal website that provides confidential information to be accessed from computers that are members of an Active Directory domain, AD CS can provide a source for the SSL certificats that will automatically be trusted.xAdcsCertificationAuthority resource has following properties:
xAdcsWebEnrollment resource has following properties:
When making changes to these resources, we suggest the following practice:
We reserve resource and module names without prefixes ("x" or "c") for future use (e.g. "MSFT_AdcsDeployment"). If the next version of Windows Server ships with a "AdcsDeployment" resource, we don't want to break any configurations that use any community modifications. Please keep a prefix such as "c" on all community modifications.
0.1.0.0
This example will add the Windows Server Roles and Features to support a Certificate Authority and configure it to provide AD CS and Web Enrollment.
Configuration CertificateAuthority
{
Node ‘NodeName’
{
WindowsFeature ADCS-Cert-Authority
{
Ensure = 'Present'
Name = 'ADCS-Cert-Authority'
}
xADCSCertificationAuthority ADCS
{
Ensure = 'Present'
Credential = $Node.Credential
CAType = 'EnterpriseRootCA'
DependsOn = '[WindowsFeature]ADCS-Cert-Authority'
}
WindowsFeature ADCS-Web-Enrollment
{
Ensure = 'Present'
Name = 'ADCS-Web-Enrollment'
DependsOn = '[WindowsFeature]ADCS-Cert-Authority'
}
xADCSWebEnrollment CertSrv
{
Ensure = 'Present'
Name = 'CertSrv'
Credential = $Node.Credential
DependsOn = '[WindowsFeature]ADCS-Web-Enrollment','[xADCSCertificationAuthority]ADCS'
}
}
}
Configuration CertificateAuthority
{
Node ‘NodeName’
{
WindowsFeature ADCS-Cert-Authority
{
Ensure = 'Present'
Name = 'ADCS-Cert-Authority'
}
xADCSCertificationAuthority ADCS
{
Ensure = 'Present'
Credential = $Node.Credential
CAType = 'EnterpriseRootCA'
DependsOn = '[WindowsFeature]ADCS-Cert-Authority'
}
WindowsFeature ADCS-Web-Enrollment
{
Ensure = 'Present'
Name = 'ADCS-Web-Enrollment'
DependsOn = '[WindowsFeature]ADCS-Cert-Authority'
}
xADCSWebEnrollment CertSrv
{
Ensure = 'Present'
Name = 'CertSrv'
Credential = $Node.Credential
DependsOn = '[WindowsFeature]ADCS-Web-Enrollment','[xADCSCertificationAuthority]ADCS'
}
}
}
Configuration RetireCertificateAuthority
{
Node ‘NodeName’
{
xADCSWebEnrollment CertSrv
{
Ensure = 'Absent'
Name = 'CertSrv'
}
WindowsFeature ADCS-Web-Enrollment
{
Ensure = 'Absent'
Name = 'ADCS-Web-Enrollment'
DependsOn = '[xADCSWebEnrollment]CertSrv'
}
xADCSCertificationAuthority ADCS
{
Ensure = 'Absent'
DependsOn = '[WindowsFeature]ADCS-Web-Enrollment'
}
WindowsFeature ADCS-Cert-Authority
{
Ensure = 'Absent'
Name = 'ADCS-Cert-Authority'
DependsOn = ‘[xADCSCertificationAuthority]ADCS’
}
}
}
Configuration RetireCertificateAuthority
{
Node ‘NodeName’
{
xADCSWebEnrollment CertSrv
{
Ensure = 'Absent'
Name = 'CertSrv'
}
WindowsFeature ADCS-Web-Enrollment
{
Ensure = 'Absent'
Name = 'ADCS-Web-Enrollment'
DependsOn = '[xADCSWebEnrollment]CertSrv'
}
xADCSCertificationAuthority ADCS
{
Ensure = 'Absent'
DependsOn = '[WindowsFeature]ADCS-Web-Enrollment'
}
WindowsFeature ADCS-Cert-Authority
{
Ensure = 'Absent'
Name = 'ADCS-Cert-Authority'
DependsOn = ‘[xADCSCertificationAuthority]ADCS’
}
}
}