deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 14:27:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Update hello-hybrid-key-trust-prereqs.md

Browse Source
This commit is contained in:
Orlando Rodriguez 2019-05-10 12:52:08 -05:00 committed by GitHub
parent c449911aee
commit 0698551ddb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
windows/security/identity-protection/hello-for-business/hello-hybrid-key-trust-prereqs.md
View File

@ -58,7 +58,20 @@ The Windows Hello for Business deployment depends on an enterprise public key in
Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object. Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object.
The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012. The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can use a 3rd Party enterprise certification authority too. The detailed requieriments for the Domain Controller certificate are shown below.
* The certificate must have a CRL distribution-point extension that points to a valid certificate revocation list (CRL).
* Optionally, the certificate Subject section should contain the directory path of the server object (the distinguished name)
* The certificate Key Usage section must contain:
Digital Signature, Key Encipherment
* Optionally, the certificate Basic Constraints section should contain:
[Subject Type=End Entity, Path Length Constraint=None]
* The certificate Enhanced Key Usage section must contain: Client Authentication (1.3.6.1.5.5.7.3.2) and Server Authentication (1.3.6.1.5.5.7.3.1)
* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name.
* The certificate template must have an extension that has the BMP data value "DomainController."
* The domain controller certificate must be installed in the local computer's certificate store
> [!IMPORTANT] > [!IMPORTANT]
> For Azure AD joined device to authenticate to and use on-premises resources, ensure you: > For Azure AD joined device to authenticate to and use on-premises resources, ensure you: