Verify both base and delta CRLs through the enrollment endpoint
CA Web Enrollment can retrieve the current base and delta certificate revocation lists. Microsoft documents prerequisites and a browser-based retrieval procedure.
Read the checklistDSE security knowledge hubIT
IT
Knowledge
Page 123 of the DSE IT knowledge center, with source-backed guidance and practical next steps.
DSE-authoredOfficial sourcesReviewed guidance
Search the library Explore this topic
Start with the cornerstone guide IT knowledge center
Production-minded guidance for endpoints, servers, updates, cloud services, administration, and supportable operations.
DSE post stream
1,513 articlesIT
Mirror trusted and disallowed CTLs for disconnected Windows systems
Windows can redirect automatic certificate-list retrieval to an internal file or web server. The documented mirror can host trusted CTLs, untrusted CTLs, or a selected subset for disconnected environments.
Read the explainer
Distribute trusted certificates through a controlled GPO
Group Policy can distribute certificates that chain to a trusted root to Windows devices in an AD domain. The documented workflow imports the certificates into a Group Policy object after prerequisites are met.
Read the guide
Back up the root CA before renewing its certificate
A root CA self-signs at the top of the PKI hierarchy, so its renewal preserves continued trust. Microsoft documents renewal with an existing or new key pair and makes root-CA backup the first procedure step.
Read the playbook
Audit weak certificate algorithms before enforcing rejection
Windows policy can reject X.509 certificates that use MD5, SHA-1, or undersized RSA keys. The policy affects certificate validation for TLS, code signing, and other Windows certificate scenarios and includes logging support.
Read the briefing
Back up both local administrator and DSRM passwords with Windows LAPS
Windows LAPS automatically manages and backs up a local administrator password for Entra-joined or AD-joined devices. It can also manage and back up the DSRM account password on AD domain controllers.
Read the checklist
Trace the Windows LAPS policy-processing and backup flow
Windows LAPS has a defined background policy-processing cycle that controls password operations. Its architecture separates Microsoft Entra password backup from Windows Server AD password backup.
Read the explainer
Choose manual or automatic LAPS account management explicitly
Windows LAPS supports distinct manual and automatic local-account management modes. Automatic account management requires Windows 11 24H2, Windows Server 2025, or later.
Read the guide
Set LAPS password or passphrase policy from measured entropy
Windows LAPS can generate random passwords or random passphrases for managed accounts. Microsoft documents the available character sets, passphrase word lists, and entropy considerations.
Read the playbook
Extend the AD schema and delegate rights before LAPS rollout
The AD-backed Windows LAPS workflow updates the schema and grants managed devices permission to write their passwords. A domain functional level earlier than 2016 cannot use Windows LAPS password encryption.
Read the briefing