CODEWITHSUNDEEP
windowskerberoswindows-authenticationpki
yosi
yosi

Reputation: 45

Windows certificate interactive logon

I'm trying to logon to domain joined computer using certificate only, I wonder if it's possible, i read allot on smart card and virtual smart card and both requires ping code. From what i understand kerberos allows authentication using PKI certificate, so the basic question Is it possible to login the user to the domain using certificate only? Thanks

Upvotes: 0

Views: 1882

Answers (1)

Steve
Steve

Reputation: 4623

Yes. You need to deploy a CA that can issue certificates for users, and configure Active Directory to support certificate authentication. This involves registering a KDC certificate on each Domain Controller and issuing certificates to users. Certificates for interactive logon can be stored in smart cards or TPMs for classic authentication scenarios as well as using e.g. Windows Hello for more modern scenarios.

The basic process is along these lines:

  1. Spin up a Certificate Authority and generate the kerberos/user auth/smart card certificate templates (Example steps
  2. Request certificates for each DC for KDC auth
  3. Request certificates for a given user (enroll cert on smart card)

From there you can require certificates for interactive logons on a per-user basis. There's a bunch of guides on how to do this such as the one linked above.

Upvotes: 1

Related Questions