Encryption in a Windows Environment: EFS File, 802.1x Wireless, IPSec Transport, and S/MIME Exchange

Next Page

Book Cover
Encryption in a Windows Environment: EFS File, 802.1x Wireless, IPSec Transport, and S/MIME Exchange
By Rand Morimoto
...............................................
Publisher: Sams
Pub Date: June 15, 2006
Print ISBN-10: 0768668298
Print ISBN-13: 978-0-7686-6829-2
Pages: 55

Table of Contents
Overview

With the current business, government, and institutional focus on security, organizations are scrambling to make their networks more secure. Although encryption is nothing new to Windows, recent advances in Microsoft® Windows 2003 and Microsoft® Windows XP have drastically simplified the support of encryption technologies in Windows environments. Delivered in Adobe PDF format for quick and easy access, Encryption in a Windows Environment: EFS File, 802.1x Wireless, IPSec Transport, and S/MIME Exchange, 1/e covers the installation and operation of EFS file encryption, IPSec communications encryption, 802.1x wireless encryption, L2TP mobile encryption, as well as the auto-enrollment of certificates that drastically simplifies the administration of encrypted communications. The encryption technologies addressed in this digital Short Cut are included in all copies of Microsoft® Windows 2003 and Microsoft® Windows XP.

Table of Contents

Section 1 What This Short Cut Will Cover

Section 2 Security the Manual Way

Section 3 Installing a Windows Certificate of Authority Server

Section 4 Implementing Encrypted File System (EFS)

Section 5 Implementing IPSec-Encrypted Transport Communications

Section 6 Implementing 802.1x Wireless Encryption

Section 7 Implementing Secured Email Communications with Exchange 2003

Section 8 Summary and Other Resources

Next Page


Table of Contents

Previous Page
Next Page

Book Cover
Encryption in a Windows Environment: EFS File, 802.1x Wireless, IPSec Transport, and S/MIME Exchange
By Rand Morimoto
...............................................
Publisher: Sams
Pub Date: June 15, 2006
Print ISBN-10: 0768668298
Print ISBN-13: 978-0-7686-6829-2
Pages: 55

Table of Contents

Copyright
Section 1.
 | What This Short Cut Will Cover
 | Security the Manual Way
 | Installing a Windows Certificate of Authority Server
 | Implementing Encrypted File System (EFS)
 | Implementing IPSec-Encrypted Transport Communications
 | Implementing 802.1x Wireless Encryption
 | Implementing Secured Email Communications with Exchange 2003
 | Summary and Other Resources

Previous Page


Copyright

Previous Page
Next Page


Section 1.

    What This Short Cut Will Cover

    Security the Manual Way

    Installing a Windows Certificate of Authority Server

    Implementing Encrypted File System (EFS)

    Implementing IPSec-Encrypted Transport Communications

    Implementing 802.1x Wireless Encryption

    Implementing Secured Email Communications with Exchange 2003

    Summary and Other Resources


What This Short Cut Will Cover

This Short Cut covers the implementation of encryption solutions in a Windows networking environment. Specifically, this book covers the step-by-step installation of Encrypted File System (EFS), IPSec-encrypted transport communications between Windows devices, 802.1x wireless encryption, and certified-based encryption in a Microsoft Exchange 2003 environment.

Learning Through Implementation

Unlike some whitepapers that spend the first 100 pages going over planning and implementation methodologies and frameworks, and another 100 pages on theoretical design and architecture of the technology for small, medium, and large organizations, this Short Cut jumps right in to configuring and implementing encryption in a Windows environment. The intention of this Short Cut is to enable you to quickly follow the step-by-step procedures so that you can implement the technologies in a lab environment.

After you successfully implement the technologies on one or two systems (or virtual sessions) in a lab environment, you will quickly understand how to configure and make the technologies work. You can then spend time reading other texts on planning, designing, and implementing the technologies in a production environment. If your production environment is a single domain in a single forest with a relatively simple environment, you might find that this Short Cut is all you need to implement the technologies in a production environment when a one- or two-server implementation meets the needs of the organization.

For IT professionals who need to expand this technology into larger or more complex environments, this Short Cut will reference resources at the end that will help you do more elaborate planning and enterprise implementations.

Having a Windows 2003 Network Infrastructure

This Short Cut assumes you have a Windows 2003 Active Directory environment. The technologies covered here do not require all servers to be Windows 2003; however, the Active Directory needs to be at a Windows 2003 level in order for autoenrollment of certificates to work, which is a core component for certificate-based security covered in this text.

Also, this Short Cut will note when the configuration being performed will only work in a Windows 2003 environment; give prerequisites for each of the components covered; and offer other tips, tricks, and lessons learned relative to the environment covered here.

Having an Understanding of Windows Networking

This Short Cut assumes you are familiar with Windows 2003 and Active Directory networking environment, such as that of a server, know what a domain controller is, and understand how to navigate around Active Directory Users and Computers or an MMC administrative tool. If you are not an expert on Windows but are pretty good at following instructions, don't worryyou will be able to easily follow along using the steps and screenshots provided in this Short Cut.

With the assumption that you have worked with Windows fairly extensively and want to jump right into understanding and configuring Windows encryption, certificates of authority, and email encryption, this Short Cut does away with introductory materials, lengthy technology introductions, and explanations of basic system configuration settings. This allows you to immediately start configuring and experiencing the operations of encrypted security in a Windows environment as quickly and effectively as possible.

Understanding the Meat of This Short Cut

This Short Cut focuses on encryption in a Windows environment as a method of securing information. The traditional method of securing information is to provide access lists of users who have access to the information. However, the problem with access list security is that once security access is provided to a user, the only way to protect the content is to remove the user from the access list.

The preferred method of security, and something that auditors have begun to request, is certificate-based encrypted security. Certificate-based means that credentials are issued by a security administrator to a user or to a computer for access to information. The certificate can be revoked and a new certificate can be issued to the same user or computer, thus allowing a user's access rights to be renewed with a new certificate in the event that the user's access information was compromised.

Using encryption scrambles the information so that someone without a valid certificate cannot read or access the information, thus providing the privacy that security and compliance auditors want for information access in today's regulated environment. The encryption is set by the certificate so that the certificate, as well as encrypted content, can be shared with others. Additionally, the certificate can be revoked and reissued for the same encrypted content to provide private and secured access to information on an ongoing basis.

The only problem with certificate-based encryption was that certificates previously had to be issued manually, which meant that every time someone needed a certificate, a security administrator had to issue the certificate and then email it to the user. When the user felt his certificate was compromised, a new certificate had to be issued, and the user had to manually reinstall the new certificate. Depending on the sophistication of the user, issuing certificates could be a help desk nightmare.

Windows 2003 Active Directory and Windows XP laptop and desktop computers now have the capability of automating the issuance and installation of certificates. With a concept known as autoenrollment of certificates, a certificate is automatically issued from a certificate server directly to a Windows 2003 Active Directory user and computer account. When the user logs in or the computer is booted up, the certificate is automatically downloaded from Active Directory to the workstation and installed. Immediately, a user or computer system has a valid certificate that can be used for secured encrypted access for files, transport communications, wireless networking, or email messaging.


Security the Manual Way

Rather than intersplicing the two or three different ways of securing files, communications, wireless, or email within each section of the balance of this Short Cut, this section will address the standard manual method of encryption all at once, and very briefly. The goal is not to educate you on how to do security the manual wayrather, by describing the manual process, it will make the automated processes, assisted by Windows 2003 autoenrollment of certificates, much clearer. Those who want to jump right in to the certificate-based autoenrollment method of encryption can skip this section and proceed directly to the "Installing a Windows Certificate of Authority Server" section.

Creating Basic Shared Folder Security

Basic security for shared folders is done by adding users from a directory list into the file permissions section of a shared folder. When a user is added to the file permissions, she can be given full control, change, or read access rights for a shared folder. To add access rights, do the following:

1.
Double-click on My Computer from the desktop of a computer system from which files will be shared.

2.
Navigate to the folder you want to share (for example, double-click on Local Disk (C:) and select a folder you might have created, such as Shared Files).

3.
Right-click on the folder and select Sharing and Security.

4.
Select the Share This Folder option, and in the Share Name field, type in what you want to call this shared folder (for example, Shared Files, Accounting Files, Marketing Documents, or Company Info).

5.
Click on the Permissions button and add or remove users you want to have access to this shared folder. You can select individual users (such as Rand, Chris, or Mike), or you can select groups of users (such as Everyone, Accounting Group, Marketing Group, or Domain Administrators).

6.
For each user or group you add, select the permissions you want them to be able to access. For example, you might want the group Everyone to only have Read and Change access to the folders, as shown in Figure 1.

Figure 1. Setting share permissions on folders.

7.
Click OK to set the permissions.

8.
Click OK to enable file sharing.

Caution

Read and Change permissions allow a user or a group of users to access a folder, subfolders, and files within the folder. The user can read the file, modify it, and add more files in the shared folder. A user with Full Control can allow or deny access to other users and effectively become the administrator for the shared folder, which you likely would not enable as a default for other users.

Users or groups of users can be added to the permissions for access to the files and shares, and access rights can be allocated for access to the information. However, for file permission access to data, the problem is that information data is not encrypted, so no privacy or information security is ensured. The only way to revoke a user's access to the information is to remove the user from the permission rights for the entire share. The security options are limited, but more details are provided in the section on "Implementing Encrypted File System (EFS)" later in this text.

Manually Configuring IPSec-Encrypted Communications

Internet Protocol Security, or IPSec ("eye-pee-sehk"), provides encrypted communications between computer systems. IPSec provides privacy of information, and limits who has access to information from a communications access perspective. With IPSec enabled on a server, the only way a user can access information over the network is to have IPSec enabled on his workstation. The encryption key used on the workstation needs to be the same as the encryption key on the server for the workstation user to successfully decrypt the communications and access the information.

The encryption and decryption keys used on the source and destination system can be created manually or automatically. In the "Creating a Group Policy for IPSec Encryption for the Server" section later in this text, the preferred automated method using group policies will be addressed. In this section, however, the manual method will be used to describe the process for server administrators to create an encryption key, and provide that information to a user who must enter the encryption key information into her computer in order to access the information on the server.

To enable manual IPSec encryption on a server, do the following:

1.
Launch the IPSec Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.

2.
Click File | Add/Remove Snap-in, and then click Add.

3.
Select IP Security Policy Management, and then click Add.

4.
Assuming you are running the MMC tool on the server on which you are configuring IPSec, choose Local Computer, and then click Finish.

5.
Click Close, and then click OK.

6.
Expand the IP Security Policies on Local Computer.

7.
Click on the Server (Require Security) option, and then right-click Properties.

8.
Click on All IP Traffic to highlight the item, and then click the Edit button.

9.
Click the Authentication Methods tab, and then click the Edit button.

10.
Select the Use This String (Preshared Key) option and, in the text box, type in an alphanumeric key (09, AF) that will become your common IPSec security key, as shown in Figure 2.

Figure 2. Creating a preshared key for manual IPSec authentication.

11.
Click OK | OK | Apply | OK to set the preshared key.

12.
Right-click on the Server (Require Security) option again and select Assign so that the IP Security Policies screen looks like what is shown in Figure 3.

Figure 3. IP Security Policies screen with Secure Server enabled.

[View full size image]

By following the preceding steps, IPSec will be configured and enabled on the server. In order for a workstation to access this server, the workstation will also need to configure and enable IPSec using the exact same shared key.

Note

We have configured the server with the Server (Require Security) option instead of the Secure Server (Request Security) option. If you do not want to force IPSec encryption on all communications, select the Secure Server (Request Security) option so that not all communications will be encrypted. However, in order for a server to successfully operate as a Secure Server, the system cannot be a domain controller, DNS server, or other utility server that has to communicate with non-IPSec systems, such as other domain controllers or an external DNS source. By requiring security, all communications must be IPSec encrypted. Therefore, to require security, the system should be a dedicated application server, and any devices that it needs to communicate with should at least have Secure Server (Request Security) enabled.

Note

The steps for configuring IPSec on a workstation are nearly identical to configuring IPSec on a server with the exception of configuring and enabling the Client (Respond Only) option.

To configure IPSec on a workstation from a Windows XP desktop or laptop, do the following:

1. | Launch the IPSec Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.
2. | Click File | Add/Remove Snap-in, and then click Add.
3. | Select IP Security Policy Management, and then click Add.
4. | Assuming you are running the MMC tool on the workstation on which you are configuring IPSec, choose Local Computer and then click Finish.
5. | Click Close, and then click OK.
6. | Expand the IP Security Policies on Local Computer.
7. | Click on the Client (Respond Only) item, and then right-click Properties.
8. | Click on Dynamic to highlight the item, and then click the Edit button.
9. | Click the Authentication Methods tab, and then click the Edit button.
10. | Select the Use This String (Preshared Key) option and, in the text box, type in the exact same alphanumeric key (09, AF) that you entered for the server IPSec configuration.
11. | Click OK | OK | Apply | Close to set the preshared key.
12. | Right-click on the Client (Respond Only) option again and select Assign to enable IPSec on the client workstation system.

Once IPSec has been enabled on both a server and a client system, the communications between the two devices will be secured and encrypted using a 168-bit encryption algorithm.

To confirm that IPSec-encrypted communications is working, run the IP Security Monitor to view the traffic between devices. To run the IP Security Monitor, do the following:

1.
Launch the IP Security Monitor Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.

2.
Click File | Add/Remove Snap-in, and then click Add.

3.
Select IP Security Monitor, and then click Add.

4.
Click Close, and then click OK.

5.
Expand the IP Security Monitor console.

6.
Expand the server you are monitoring.

7.
Click to expand the Quick Mode, and then click on the Security Associations folder to view the connections (both encrypted and unencrypted). You will see a list of connections similar to the ones shown in Figure 4.

Figure 4. IP Security Monitor connection status.

[View full size image]

Note

Connections that are encrypted will show ESP Confidentiality with 3DES or another encryption method noted for the connections setting. Because the server is configured with requested security and not required security in this example, you can have some connections that have <None> as the ESP Confidentiality (note that those connections are not encrypted).

The problem with manual IPSec encryption is that the key is static, meaning that if the key information is accidentally or purposely shared with someone who should not have access to the information, although the information will be encrypted, virtually anyone can have access to the information. By automating encryption using certificates, if a key is compromised, new keys can be automatically issued to computer systems, thus enabling access to any computer that has the new encryption key. The automated process will be covered in the "Implementing IPSec-Encrypted Transport Communications" section later in this text.

Using Wired Equivalent Privacy (WEP) for Wireless Security

Wireless communication security using the Wired Equivalent Privacy, or WEP ("wehp"), is very similar to the shared key system in IPSec. Effectively, a wireless access point has a static key entered into the security table of the device. In order for laptop or wireless devices to connect to the wireless access point, the client needs to enter the static key into her computer system. The shared information provides a common secured link between the wireless client and the wireless network.

To enable WEP on an access point device, you would enter a series of numbers and letters (09, AF, no spaces or punctuation) into the access point WEP configuration page. Every access point device has a slightly different configuration page option; however, a sample page is shown in Figure 5.

Figure 5. Sample access point WEP configuration page.

[View full size image]

In this example, WEP has been configured with 128-bit encryption, thus requiring 26 hexadecimal digits in the encryption key.

After WEP is configured on the access point device, the user needs to manually enter the exact same WEP key into the wireless configuration settings on his laptop or mobile device. In Windows XP, the process is as follows:

1.
From the Windows XP desktop, click on Start | Control Panel | Network Connections.

2.
Right-click on the wireless network adapter connection for the device, and select Properties.

3.
Click on the Wireless Networks tab.

4.
Click on the wireless network that you want to connect to (this is known as the SSID of the access point you are connecting to), and then click on the Properties button.

5.
For Network Authentication, choose Open. For Data Encryption, choose WEP.

6.
Unclick the The Key Is Provided for Me Automatically check box. This will allow you to enter your security key.

7.
In the Network Key field, enter the 26-hexadecimal WEP key that was associated with the access point. Re-enter the same key in the Confirm Network Key field. The completed screen should look similar to what is shown in Figure 6.

Figure 6. Wireless configuration setting on the Windows XP laptop.

8.
Click OK and then OK to set and enable the WEP encryption settings for the system.

Unfortunately, just like shared-key IPSec, if the WEP key is compromised by someone providing information to people who should not have access to the key, virtually anyone with the key will then have access to the wireless access device. The only way for the organization to resecure wireless access is to change the WEP key on the access point device, and then tell all users what the new access key is for wireless access. It could be just a matter of days or hours before that wireless access key is compromised, and then the process starts all over again for reissuing a new key.

Basic Encrypted Communications Using Outlook

Encryption is also used for email communications to enable users to send and receive secured communications between each other. In Microsoft Exchange, there is an encryption system built in that allows users within an Exchange environment to send email messages to other users within that environment in an encrypted manner. The problem with the default encryption in Exchange is that it does not provide encryption outside of the company's Exchange environment. So most organizations do not use the built-in email encryption in Exchange, but rather a more standard method of encrypted communications built on the Public Key Infrastructure (PKI) standard.

There are several methods of providing encrypted communications between users within and external to a Microsoft Exchange and Outlook email system. Users can each get a certificate from an organization such as VeriSign and perform encrypted communications. Or an organization can purchase an enterprise license of Pretty Good Privacy (PGP) that provides encryption between users and organizations also using PGP email security. In the following example, the use of individual VeriSign certificates will be explained.

A user who wants to encrypt messages between herself and another user needs to get an individual email certificate and install it in her Microsoft Outlook email client software. The user would go to http://www.verisign.com/products-services/security-services/pki/pki-application/email-digital-id/index.html and, for approximately $20 a year, both users can purchase a certificate. The individuals share the public portion of their certificates with the others with whom they want to communicate using encrypted messaging.

To acquire a certificate, do the following:

1. | Go to a certificate provider such as VeriSign (http://www.verisign.com/products-services/security-services/pki/pki-application/email-digital-id/index.html), and sign up and purchase a Digital ID.
2. | Follow the instructions to download and install the certificate in your Outlook client.
3. | Have the user you want to communicate with do the same.

This process of purchasing, downloading, and installing a certificate only needs to be done once a year.

Note

If you use multiple computers, you need to install the certificate on each machine that runs the Outlook client in order to send and receive encrypted email messages.

After you have downloaded and installed the certificate on your computer, you need to configure Outlook to support the certificate. To do so, do the following:

1.
Launch Outlook.

2.
Choose Tools | Options, and then click on the Security tab.

3.
Click the Settings button.

4.
Enter Email Encryption for the Security Settings Name, choose S/MIME for Cryptographic Format, and then select the check boxes for Default Security Setting for This Cryptographic Message Format and Default Security Setting for all Cryptographic Messages.

5.
Choose SHA1 for Hash Algorithm and 3DES for Encryption Algorithm.

6.
Select the Send These Certificates with Signed Messages option.

7.
The settings should look similar to the ones shown in Figure 7. Click OK to accept these settings, and then OK again.

Figure 7. Configuring Microsoft Outlook to support the encryption certificate.

Depending on the user's computer sophistication, he might have difficulties signing up, downloading, and installing the certificate, as well as configuring his Outlook client to send emails. Additionally, because the certificates are individual-based, each individual user has to do this process himself every year and for every system on which he conducts email communications. As you will see in the "Implementing Secured Email Communications with Exchange 2003" section, the issuance of certificates and the configuration of the user's Outlook client can be completed automatically using autoenrollment of certificates, as well as using group policy objects in Windows 2003 Active Directory.


Installing a Windows Certificate of Authority Server

The manual processes noted in the previous section showed what is involved in manually enabling security in a Windows and Exchange environment. Beyond the complexity of users having to perform critical system tasks to enable and access secured information, the security provided by these manual methods is not even that good. A simple compromise of a shared key can invalidate the security of files, access systems, and secured communications. The better method is to use a certificate-based security system using encryption to provide a significantly higher level of security. Additionally, by automating the process, users do not have to be involved in the encryption, transport, or communications between their laptop or desktop, and the network.

This section covers the creation of a certificate of authority server system that issues certificates and the process known as autoenrollment of certificates that automatically issues certificates to users and computers in a Windows 2003 Active Directory environment.

Note

This section assumes that you have a Windows 2003 server that has been fully patched with the latest Windows 2003 service pack and updates and that the server is connected to a Windows 2003 Active Directory network. If you are creating this system in a limited lab environment, the certificate server can be added on the same server system as the global catalog server so that a single domain controller and certificate server can be used.

Adding the Certificate Service to a Server

The Certificate Service is the Windows service that allocates certificates to be issued to users and computers. It is nothing more than a service added to an existing Windows 2003 server system.

To install the Certificate Service to a system, do the following:

1.
On the server that will become your certificate server, click on Start | Settings | Control Panel.

2.
Double-click on Add or Remove Programs, and then click on Add/Remove Windows Components.

3.
Select the check box for Certificate Services. The warning note that pops up will inform you that once you install Certificate Services on this system, you cannot change the server name or domain membership. Assuming you are okay with this, click Yes to continue.

4.
If you have not installed IIS Web Services on this system yet, in the Windows Components screen, highlight Application Server and click on Details.

5.
Select the Internet Information Services (IIS) check box, and then click OK. Then click Next to begin the installation of the Certificate Services and IIS components.

6.
Assuming this is the first certificate server in your environment, choose Enterprise Root CA for the type of certificate of authority server, and then click Next.

7.
For the common name for this CA, enter a name. Typically, the name of the server is selected; however, a distinguishable name such as xyzCertServer (where xyz is a short name of the company) can help identify the certificate server in the future.

8.
Leave the Distinguished Name Suffix and the Validity Period as is. The CA Identifying Information page should look similar to what is shown in Figure 8. Then click Next.

Figure 8. Certificate identifying information settings.

9.
Click Next through the defaults of the Certificate Database Settings page (click Yes through the warning that IIS must be temporarily stopped). Click Finish after the installation of the component files has been completed.

Configuring Autoenrollment of Certificates

After the certificate service has been installed on the system, the administrator of the network can issue certificates to users and computers. However, rather than manually generating and issuing certificates, the best practice is to have the certificate server automatically issue certificates to users and computers in Active Directory. This is known as autoenrollment of certificates.

Autoenrollment of certificates requires the following:

1. | A certificate template needs to be created.
2. | The template needs to be added to the Certificate of Authority server.
3. | A group policy needs to be created to automatically deploy the certificate to the user or computer.

With autoenrollment of certificates, rules are created that define which certificates should be issued to a user or computer. For example, a rule can be created for the autoenrollment of a certificate, allowing a user to have her certificates automatically created for the encryption of data files. With autoenrollment of encrypted files, the user can simply save files to a shared location, and the files stored in that location will be encrypted.

To have certificates automatically installed for the users in Active Directory, do the following:

1.
On the certificate server you just created, launch the Certificate Template Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.

2.
Click File | Add/Remove Snap-in, and then click Add.

3.
Select Certificate Templates, and then click Add.

4.
Click Close, and then click OK.

5.
Click on the Certificate Templates folder.

6.
Right-click on the User Template and select Duplicate Template.

7.
For the Template Display Name, enter AutoEnroll User.

8.
Make sure the Publish Certificate in Active Directory and the Do Not Automatically Reenroll If a Duplicate Certificate Exists in Active Directory options are both checked. The screen should look similar to Figure 9.

Figure 9. Creating the AutoEnroll user template.

9.
Click on the Security tab.

10.
Highlight the Authenticated Users Name and select the check boxes to Allow for Enroll and Autoenroll for the Authenticated Users. The result will have the Read, Enroll and the Autoenroll checkboxes selected.

11.
Click OK.

Adding the Template to the Certificate Server

Once the AutoEnroll user template has been created, the template needs to be added to the certificate server and distributed to users. This is done by the following:

1. | Launch the Certification Authority Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.
2. | Click File | Add/Remove Snap-in, and then click Add.
3. | Select the Certification Authority snap-in and then click Add. Assuming you are on the certificate server, select Local Computer, and then click Finish.
4. | Click Close, and then click OK.
5. | Expand the Certification Authority folder.
6. | Expand the folder for your Certificate Server.
7. | Right-click on the Certificate Templates folder and select New | Certificate Template to Issue.
8. | Highlight the AutoEnroll user template, and then click OK.

Note

This step of adding the AutoEnroll user template you created earlier adds this new template to the certificate server. The AutoEnroll user template allows user certificates to be issued automatically through Group Policy.

Creating a Group Policy to Distribute User Certificates

The next step for autoenrollment is to create a group policy that can then distribute user certificates to the users' laptops and desktops automatically. This is done by creating a group policy and having the group policy distribute the certificates created in the previous step. To create this group policy, do the following:

1.
Launch the Active Directory Users and Computers tool by selecting Start | Programs | Administrative Tools and choosing Active Directory Users and Computers.

2.
Right-click on the forest name of the network (such as companyabc.com) and choose Properties.

3.
Click on the Group Policy tab.

4.
Highlight the Default Domain Policy and click Edit.

5.
Under the User Configuration container, expand the Windows Settings folder.

6.
Expand the Security Settings folder and then click to select the Public Key Policies folder. You will see an object type named Autoenrollment Settings, as shown in Figure 10.

7.
Right-click the Autoenrollment Settings object and select Properties.

8.
Check the Renew Expired Certificates, Update Pending Certificates, and Remove Revoked Certificates options as well as the Update Certificates That Use Certificate Templates option. Then click OK.

Figure 10. Expanding folders to access the Autoenrollment Settings object.

[View full size image]

Validating That Certificates Are Working Properly

The autoenrollment of user certificates has now been configured for all users that log on to the domain. To validate that certificates are working properly, do the following:

1.
From a Windows XP workstation, log on to the domain.

2.
Launch the Certificates Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.

3.
Click File | Add/Remove Snap-in, and then click Add.

4.
Select Certificates Snap-in and then click Add. Assuming you logged in as the user and you want to verify that certificates are working, choose My User Account, and then click Finish.

5.
Click Close, and then click OK.

6.
Expand the Certificates Current User folder.

7.
Expand the Personal folder and click to highlight the Certificates folder.

8.
You should have a Client Authentication certificate created by the AutoEnroll User certificate template, as shown in Figure 11.

Figure 11. Certificate automatically added to the user's Certificates folder.

[View full size image]

The autoenrollment of certificate process will be covered in each of the following sections for the autoenrollment and distribution of certificates for file encryption, transport encryption, wireless encryption, and email encryption.


Implementing Encrypted File System (EFS)

File system encryption is an important security function in that the process not only limits who has access to secured data files, but it also encrypts the content of the files so that even if a system is compromised, the data is encrypted and cannot be easily accessed.

With the creation of the AutoEnroll user template in the previous section, certificate-based EFS encryption is automatically configured for users managed by the defined group policy.

Encrypting Files Using Certificates

The file encryption process is initiated by a user choosing a file or folders and noting that the file(s) should be encrypted. To encrypt files, do the following:

1.
Double-click on My Computer from the desktop of a computer system from which files will be encrypted.

2.
Navigate to a folder that you want to encrypt (for example, double-click on Local Disk (C:) and identify the folder you want to encrypt).

3.
Right-click on the folder and select Properties.

4.
Click on the Advanced button at the bottom of the Properties page.

5.
Check the Encrypt Contents to Secure Data option so the screen looks similar to Figure 12.

Figure 12. Selecting to encrypt the contents of data.

6.
Click OK. If you selected a folder to encrypt, you will be prompted to choose just the folder selected, or the folder and all subfolders and files. Click OK.

You will notice the file(s) and folder(s) will turn green to show that the files have been encrypted.

Validating That a Certificate Has Been Issued for File Encryption

To validate that a certificate has been issued by the certificate server for encryption, go to the certificate server and do the following:

1.
Launch the Certification Authority Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.

2.
Click File | Add/Remove Snap-in, and then click Add.

3.
Select the Certification Authority snap-in and then click Add. Assuming you are on the certificate server, select Local Computer, and then click Finish.

4.
Click Close, and then click OK.

5.
Expand the Certification Authority folder.

6.
Expand the folder for your certificate server.

7.
Click on the Issued Certificates container and you will see a series of certificates issued. In the example shown in Figure 13, the user chris had a Basic EFS certificate issued to him for the purpose of EFS file encryption.

Figure 13. Confirming a user received a certificate for file encryption.

[View full size image]

Ensuring a Recovery Key Agent or Administrator Exists for File Recovery

Critical to the recovery of encrypted files is the responsibility of the network administrator to create and manage a recovery key for EFS data certificates. In the event that a user loses or deletes his certificate, or leaves the organization, someone needs to seize control of the encrypted files. Having a recovery agent for EFS files will assist in the decryption and recovery of files.

By default, the administrator is added to the Default Domain Policy group policy object as the sole individual who can decrypt EFS files. You can choose to add other individuals with the right to decrypt files, or you can change who has the file decryption rights by Group Policy. To view, edit, or change who has the rights to decrypt EFS files, do the following:

1.
Launch the Active Directory Users and Computers tool by selecting Start | Programs | Administrative Tools and choosing Active Directory Users and Computers.

2.
Right-click on the forest name of the network (such as companyabc.com) and choose Properties.

3.
Click on the Group Policy tab.

4.
Highlight the Default Domain Policy and click Edit.

5.
Under the Computer Configuration container, expand the Windows Settings folder.

6.
Expand the Security Settings folder and then expand the Public Key Policies folder. Click on the Encrypting File System container and you will see the Administrator as the user who has rights to decrypt EFS files similar to what is shown in Figure 14.

Figure 14. The administrator as the individual who can decrypt EFS files.

[View full size image]

Recovering Encrypted Files Using the Recovery Key

To recover files that were once encrypted by a network user, do the following:

1. | Right click on the Administrator in the Encrypting File System container and choose All Tasks | Export, and then click Next to continue.
2. | Click Yes, Export the Private Key, and then click Next.
3. | Choose Personal Information Exchange and ensure that the Enable Strong Protection option is checked, and then click Next.
4. | Enter a password that you will use in association with this export certificate, and then click Next to continue.
5. | Type in the name of the file you want this certificate to export as (such as c:\recoverycert), and then click Next to continue.
6. | Click Finish.

You can now copy the certificate to a USB thumb drive or other device and take the certificate to a system that needs its files recovered.

Note

You want to be very careful with this exported certificate. It is a master key to unlock any encrypted file on the entire network managed by this group policyidentified individual. One way to protect the key is to export it only for the time you need to recover files, and then delete the key so that it must be exported again for use. Another option is to set encryption recovery at an OU level and associate different individuals as recovery agent administrators. This will allow the organization the ability to associate a different administrator to recover finance- and HR-encrypted documents, rather than common-use word processing and spreadsheet documents.

Now that you have exported the recovery certificate, to recover the files on a system do the following:

1. | Log on to a workstation in which you want to recover encrypted files.
2. | Launch the Certificates Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.
3. | Click File | Add/Remove Snap-in, and then click Add.
4. | Select Certificates Snap-in and then click Add. Assuming you logged in as the user and you want to verify that certificates are working, choose My User Account, and then click Finish.
5. | Click Close, and then click OK.
6. | Expand the Certificates Current User folder.
7. | Expand the Personal folder, and then right-click on the Certificates subfolder and choose All Tasks | Import. Click Next to continue.
8. | Type in the filename of the certificate you exported from the server (for example, c:\recoverycert.pfx), and then click Next to continue.
9. | Enter the password you entered when you exported the certificate from the server, and then click Next.
10. | Click Next in the Certificate Store by agreeing to have the certificate placed in the Personal Certificate store, and then click Finish.
11. | Click OK when prompted that the certificate was successfully imported.

Now that you have temporarily imported the administrator file recovery certificate, you can access files that once were inaccessible. You cannot simply cut and paste the files to other directories, though. You need to decrypt the files first, and then place them in other folders. The reason you need to decrypt the files is that they are still encrypted with the old certificate. Simply copying and pasting the files to another directory will retain the old certificate associated to the files. By decrypting the files and then moving them into a new folder, the files will take on any encryption associated with the new folder.

To decrypt files, do the following:

1.
Double-click on My Computer from the desktop of a computer system from which files will be decrypted.

2.
Navigate to a folder that you want to share (for example, double-click on Local Disk (C:) and identify a folder you want to decrypt).

3.
Right-click on the folder and select Properties.

4.
Click on the Advanced button at the bottom of the Properties page.

5.
Uncheck the Decrypt Contents to Secure Data option so the screen looks similar to Figure 15.

Figure 15. Selecting to decrypt the contents of data.

6.
Click OK. If you selected a folder to decrypt, you will be prompted to apply the changes to the folder as well as subfolders and files. Click OK, and then OK.

After you decrypt the files, you can move the files to other folders or just leave the files in the existing folders. Immediately after decrypting the files, you want to remove the administrator recovery key from the system. To do so, do the following:

1. | Launch the Certificates Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.
2. | Click File | Add/Remove Snap-in, and then click Add.
3. | Select Certificates Snap-in, and then click Add. Assuming you logged in as the user and you want to verify that certificates are working, choose My User Account, and then click Finish.
4. | Click Close, and then click OK.
5. | Expand the Certificates Current User folder.
6. | Expand the Personal folder, and then expand the Certificates subfolder.
7. | Click to select the Administrator certificate (noted with File Recovery as the Intended Purpose) and press the Delete key. You will be prompted that you will not be able to decrypt data using the certificate. Select Yes to continue.

With the administrator certificate successfully removed from the system, you can now have the user move, encrypt, or manage her files, and all changes will be made with her existing EFS certificate key.


Implementing IPSec-Encrypted Transport Communications

IPSec encryption provides a security system that encrypts communications from a server to a workstation client system. Rather than using a shared key described earlier in this text, the use of Kerberos encryption managed by an Active Directory group policy provides a simple method of encrypting communications between client systems and servers.

Note

In this case we're using Kerberos for the encrypted authentication method instead of certificates. The reason is that Active Directory does not store a central directory of user certificates that can be distributed by Group Policy for automatic IPSec configuration. However, Windows Active Directory does provide Kerberos for automatic IPSec configuration, so in this case, Windows Kerberos is the better solution for automating IPSec-encrypted communications.

Creating a Group Policy for IPSec Encryption for the Server

Assuming the server for this test implementation is a domain controller, we can simply edit the Default Domain Controller group policy to represent the group policy object for the server. In a production environment, you may choose to create an Organization Unit (OU), place servers into the server container, and then apply the following group policy specifically to the OU. However, to proceed with the assumption that the policy will apply to the Default Domain Controller group policy, do the following:

1.
Launch the Active Directory Users and Computers tool by selecting Start | Programs | Administrative Tools and choosing Active Directory Users and Computers.

2.
Right-click on the Domain Controllers container of the network (such as companyabc.com) and choose Properties.

3.
Click on the Group Policy tab.

4.
Highlight the Default Domain Controller Policy and click Edit.

5.
Under the Windows Configuration container, expand the Windows Settings folder.

6.
Expand the Security Settings folder and then click on IP Security Policies so your screen will look something like Figure 16.

Figure 16. IP Security Policies for Default Domain Controllers.

[View full size image]

7.
Click on the Server (Request Security) item, and then right-click Properties.

8.
Click on All IP Traffic to highlight the item, and then click the Edit button.

9.
Click the Authentication Methods tab, and then click the Edit button.

10.
Select the Active Directory default (Kerberos V5 protocol) option.

11.
Click OK | OK | Apply, and then click OK to set the IPSec server setting.

12.
Right-click on the Server (Request Security) option again and select Assign so that the IP Security Policy Assigned notes Yes.

This policy will be set for all domain controllers on the network. Dropping to the DOS prompt and typing GPupdate/Force will initiate this policy to the domain controller server system.

Creating a Group Policy for IPSec Encryption for the Client

Applying a group policy to clients is the same as applying a group policy to the servers. However, you want to create a policy that will apply to the laptops and desktops of the network and not on the servers. This is typically done by creating an Organizational Unit (OU) and then placing the workstations into the container. To create a group policy for IPSec encryption on a client system, do the following:

1. | Launch the Active Directory Users and Computers tool by selecting Start | Programs | Administrative Tools and choosing Active Directory Users and Computers.
2. | Right-click on the forest name of the network (such as companyabc.com) and choose New | Organizational Unit.
3. | Enter the name of the OU into which you will be placing the workstations. An example might be C-SanFrancisco, meaning a container holding San Francisco computers.
4. | Right-click on the OU container you just created, and choose Properties.
5. | Click on the Group Policy tab.
6. | Click on New and give the new group policy a name (for example, C-OU-SF-Security, meaning a computer policy for the San Francisco OU that addresses security policy items).
7. | Highlight the new policy, and then click Edit.
8. | Under the Windows Configuration container, expand the Windows Settings folder.
9. | Expand the Security Settings folder, and then click on IP Security Policies.
10. | Click on the Client (Respond Only) item, and then right-click Properties.
11. | Click on the <Dynamic> IP Filter item to highlight it, and then click the Edit button.
12. | Click the Authentication Methods tab, and then click the Edit button.
13. | Select the Active Directory default (Kerberos V5 protocol) option.
14. | Click OK | OK | Apply, and then click OK to set the IPSec setting.
15. | Right-click on the Client (Respond Only) option again and select Assign so that the IP Security Policy Assigned notes Yes.

This policy will be set for all workstations that are in this OU. Dropping to the DOS prompt on a workstation and typing GPupdate /Force will initiate this policy for the workstations.

Confirming That IPSec-Encrypted Communications Is Working

To confirm that IPSec-encrypted communications is working, run the IP Security Monitor to view the traffic between devices. To run the IP Security Monitor, do the following:

1.
Launch the IP Security Monitor Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.

2.
Click File | Add/Remove Snap-in, and then click Add.

3.
Select IP Security Monitor, and then click Add.

4.
Click Close, and then click OK.

5.
Expand the IP Security Monitor console.

6.
Expand the server you are monitoring.

7.
Click to expand the Quick Mode, and then click on the Security Associations folder to view the connections (both encrypted and unencrypted) as shown in Figure 17.

Figure 17. Monitoring encryption operations with the IPSec monitor.

[View full size image]

Note

Connections that are encrypted will show ESP Confidentiality with 3DES or another encryption method noted for the connections setting. Because the server is configured with requested security and not required security in this example, you can have some connections that have <None> as the ESP Confidentiality (note that those connections are not encrypted).


Implementing 802.1x Wireless Encryption

Encrypted wireless communications use the exact same policy-based encrypted communications process used in IPSec encryption. Rather than using a static WEP key to provide secured communications between a client system and a wireless access point, a certificate is used to encrypt communications between client systems and the network. This certificate is issued through the use of group policies that enable the automated distribution of security for wireless systems.

Preparing for Wireless Configuration

There are a couple things that must be added to Active Directory in order for automatic wireless encryption operations to work properly.

One is that your Active Directory should be in Windows 2003 functional level so that you can configure remote access policy for clients using a group policy. This is not mandatoryyou can always configure each user to have remote access manually; however, it is a lot easier to do it through a policy.

If you want to raise the functional level of your domain to Windows 2003 functional level, do the following:

1.
Launch the Active Directory Users and Computers utility by clicking on Start | Programs | Administrative Tools, and select Active Directory Users and Computers.

2.
Right-click the forest name (for example, companyabc.com) and choose the Raise Domain Functional Level option.

3.
As shown in Figure 18, select Windows 2003 for the functional level (if the domain is on Windows 2000 for the functional level), and then click OK.

Figure 18. Raising the domain functional level to Windows 2003.

Once in a Windows 2003 functional level, you will be able to set the remote access policy through a group policy object.

The second requirement is to install Windows 2003 Internet Authentication Service (IAS) on a server. IAS will provide secured authentication to the network. To install IAS, do the following:

1. | On the server that will become your IAS server, click on Start | Settings | Control Panel.
2. | Double-click on Add or Remove Programs, and then click on Add/Remove Windows Components.
3. | Highlight the Networking Services option and click the Details button.
4. | Select the check box for Internet Authentication Service, and then click OK.
5. | Click Next to install IAS on the system, and then click Finish after IAS has been installed.

After IAS has been installed, you'll need to configure the IAS service. You configure IAS by doing the following:

1. | Launch the IAS Administrative Tool by clicking on Start | Programs | Administrative Tools, and select Internet Authentication Service.
2. | Right-click Internet Authentication Service (Local) on the main screen of the administrative tool and choose Register Server in Active Directory.
3. | When prompted to authorize the computer to read users' dial-in properties, click OK, and then continue to click OK through the rest of the prompts.
4. | Right-click on the RADIUS Clients folder and choose New RADIUS Client.
5. | For the Friendly Name, enter anything that is descriptive of the access point to which you are setting up RADIUS access. (It could be something such as Conference Room A Access Point.) Then enter the IP address of the access point, and click Next.
6. | Select RADIUS Standard for the Client-Vendor option, and enter the Shared Secret word that will link your IAS server to your access point for security, as shown in Figure 19. (It could be something such as iaswirelessjust make sure you enter that same Shared Secret word on the access point configuration page.)

Figure 19. Setting the RADIUS standard and Shared Secret word configuration.

[View full size image]

Creating a Wireless Remote Access Policy

Your next step is to create a wireless remote access policy. To do so, do the following:

1.
Right-click the Remote Access Policies item on the Internet Authentication Service (Local) administration tool page and choose New Remote Access Policy.

2.
Click Next to begin the wizard.

3.
Choose Use the Wizard to Set Up a Typical Policy for a Common Scenario and enter a policy name such as Wireless Access Policy, and then click Next.

4.
Select Wireless for the Access method, as shown in Figure 20, and then click Next.

Figure 20. Choosing wireless access for the remote access policy in IAS.

[View full size image]

5.
Click the Add button to select the group(s) that you want to grant wireless access, and then click Next.

6.
Specify Protected EAP (PEAP) for the Authentication method, and then click Next.

7.
Click Finish when done.

Configuring a Group Policy to Limit Supported Access Points

The next step is to configure a group policy to limit the access points the clients can connect to on the network, as well as enforce the 802.1x wireless encryption policy. To configure the group policy, do the following:

1.
Launch the Active Directory Users and Computers tool by selecting Start | Programs | Administrative Tools and choosing Active Directory Users and Computers.

2.
Right-click on the forest name of the network (such as companyabc.com) and choose Properties.

3.
Click on the Group Policy tab.

4.
Highlight the Default Domain Policy and click Edit.

5.
Under the Computer Configuration container, expand the Windows Settings folder, and then expand the Security Settings folder.

6.
Right-click on the Wireless Network (IEEE 802.11) Policies option and choose Create Wireless Network Policy, and then click Next.

7.
Give the Wireless Network Policy a name such as Wireless Network Group Policy, and then click Next.

8.
With the Edit Properties checked, click Finish.

9.
Leave the Policy Change setting to the default 180 minutes. Change the Networks to Access so they are Access Point (Infrastructure) Networks Only. Check the Use Windows to Configure Wireless Network Settings option, and uncheck the Automatically Connect to Non-preferred Networks option.

10.
Click on the Preferred Networks tab, and then click the Add button and enter the names of the SSIDs that you want the users to access. Typically, you would have your Network Authentication to Open, your Data Encryption to WEP, and you would uncheck The Key Is Provided Automatically, as well as make sure the Ad Hoc Network option is unchecked.

11.
Click on the IEEE 802.1x tab. Change the EAP type to PEAP so the screen looks similar to what is shown in Figure 21, and then click OK.

Figure 21. Setting IEEE 802.1x settings.

Tuning Windows XP to Process Policies

After the policy has been set in Active Directory, a minor tweak needs to be made to resolve a problem in Windows XP in which a wireless device logs on in a sequence that causes wireless connection, group policy processing, and authentication problems. This involves making Windows XP process scripts and policies serially rather than in parallel. This can be set in a group policy as follows:

1.
Launch the Active Directory Users and Computers tool by selecting Start | Programs | Administrative Tools and choosing Active Directory Users and Computers.

2.
Right-click on the forest name of the network (such as companyabc.com) and choose Properties.

3.
Click on the Group Policy tab.

4.
Highlight the Default Domain Policy and click Edit.

5.
Under the Computer Configuration container, expand the Administrative Templates folder, and then expand the System folder.

6.
Click on the Logon container.

7.
Double-click on the Always Wait for the Network at Computer Startup and Logon group policy object and choose Enabled, as shown in Figure 22, and then click OK.

Figure 22. Setting a group policy to support network logon sequencing.

[View full size image]

With the policies applied to the wireless systems, the devices will use 802.1x wireless leveraging PEAP to access the network for secured wireless connection.


Implementing Secured Email Communications with Exchange 2003

Encrypted email communications is simply done through the implementation of autoenrollment of certificates for email that are issued to users via Group Policy. Email encryption can be automated to the point where users are effectively issued certificates, the certificates are automatically installed, and the user can immediately begin to send and receive messages using encrypted communications.

If you have completed the steps at the very beginning of this text for the autoenrollment of certificates for a user, the certificate will automatically work for Exchange Outlook encryption.

To validate that the certificate has installed, simply do the following:

1. | Launch Microsoft Outlook email.
2. | Select Tools | Options, and then click on Security tab.
3. | Click on Settings and My S/MIME Settings should automatically be configured for the user.
4. | Click OK, and then OK again, to exit.

With a certificate already issued for Outlook, users can begin to send and receive encrypted emails with other users in the organization.

Specifically Configuring Exchange User Certificate Operations

If you have not already set up an AutoEnroll User certificate template described in the "Configuring Autoenrollment of Certificates" section earlier in this text, or if you want to create an Exchange User certificate template independent of the user template, then you can complete the following process.

To have certificates automatically installed for the Exchange users in Active Directory, do the following:

1.
On the certificate server you just created, launch the Certificate Template Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.

2.
Click File | Add/Remove Snap-in, and then click Add.

3.
Select Certificate Templates, and then click Add.

4.
Click Close, and then click OK.

5.
Click on the Certificate Templates folder.

6.
Right-click on the Exchange User template and select Duplicate Template.

7.
For the Template display name, enter Autoenroll Exchange User.

8.
Make sure the Publish Certificate in Active Directory and the Do Not Automatically Reenroll options are both checked. The screen should look similar to Figure 23.

Figure 23. Creating an AutoEnroll Exchange User template.

9.
Click on the Security tab.

10.
Highlight the Authenticated Users name and select the check boxes to Allow for Enroll and Autoenroll for the Authenticated Users. The result will have the Read, Enroll and the Autoenroll check boxes selected.

11.
Click OK.

Adding the Template to the Certificate Server

After an AutoEnroll Exchange User template has been created, the template needs to be added to the certificate server and distributed to users. This is done by the following:

1. | Launch the Certification Authority Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.
2. | Click File | Add/Remove Snap-in, and then click Add.
3. | Select the Certification Authority snap-in and then click Add. Assuming you are on the certificate server, select Local Computer, and then click Finish.
4. | Click Close, and then click OK.
5. | Expand the Certification Authority folder.
6. | Expand the folder for your certificate server.
7. | Right-click on the Certificate Templates folder and select New | Certificate Template to Issue.
8. | Highlight the AutoEnroll Exchange User template, and then click OK.

Note

This step of adding the AutoEnroll Exchange User template you created earlier adds this new template to the certificate server. The AutoEnroll User template will allow user certificates to be issued automatically through Group Policy.

Creating a Group Policy to Distribute User Certificates

The next step for autoenrollment is to create a group policy that can then distribute certificates to the users' laptops and desktops automatically. This is done by creating a group policy and having the group policy distribute the certificates created in the previous step. To create this group policy, do the following:

1. | Launch the Active Directory Users and Computers tool by selecting Start | Programs | Administrative Tools and choosing Active Directory Users and Computers.
2. | Right-click on the forest name of the network (such as companyabc.com) and choose Properties.
3. | Click on the Group Policy tab.
4. | Highlight the Default Domain Policy and click Edit.
5. | Under the User Configuration container, expand the Windows Settings folder.
6. | Expand the Security Settings folder and then click to select the Public Key Policies folder. You will see an Autoenrollment Settings object, as shown in Figure 24.
7. | Right-click the Autoenrollment Settings object and select Properties.
8. | Check the Renew Expired Certificates, Update Pending Certificates, and Remove Revoked Certificates option, as well as the Update Certificates That Use Certificate Templates option. Then click OK.

Figure 24. Expanding folders to access the Autoenrollment Settings object.

[View full size image]

Validating That Certificates Are Working Properly

The autoenrollment of user certificates has now been configured for all users that log on to the domain. To validate that certificates are working properly, do the following:

1. | From a Windows XP workstation, log on to the domain.
2. | Launch the Certificates Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.
3. | Click File | Add/Remove Snap-in, and then click Add.
4. | Select the Certificates snap-in and then click Add. Assuming you logged in as the user and you want to verify that certificates are working, choose My User Account, and then click Finish.
5. | Click Close, and then click OK.
6. | Expand the Certificates Current User folder.
7. | Expand the Personal folder and click to highlight the Certificates folder.
8. | You should have a Client Authentication certificate created by the AutoEnroll Exchange User certificate template, as shown in Figure 25.

Figure 25. Exchange User certificate added to the user's Certificates folder.

[View full size image]

If for some reason the Exchange User certificate has not pushed to the user's certificate container, you can easily add the certificate by doing the following:

1. | From a Windows XP workstation, log on to the domain.
2. | Launch the Certificates Microsoft Management Console (MMC) by clicking Start | Run and typing mmc.exe; then click OK.
3. | Click File | Add/Remove Snap-in, and then click Add.
4. | Select the Certificates snap-in and then click Add. Assuming you logged in as the user and you want to verify that certificates are working, choose My User Account, and then click Finish.
5. | Click Close, and then click OK.
6. | Expand the Certificates Current User folder.
7. | Expand the Personal folder, right-click the Certificates folder, and choose All Tasks | Request New Certificate; then click Next to begin the wizard.
8. | Highlight AutoEnroll Exchange User, and then click Next.
9. | Click Next through the Friendly Name and Description page.
10. | Click Finish.

Making Sure Outlook Acknowledges the Certificate

After autoenrollment has issued a certificate to the user, and the user has confirmed that the certificate has been successfully received, you can confirm that Microsoft Outlook recognizes the certificate for encrypted communications. To do so, do the following:

1. | Launch Outlook.
2. | Choose Tools | Options, and then click on the Security tab.
3. | Click the Settings button. Note that under Security Settings Name is the email certificate that will enable you to send and receive encrypted communications.
4. | Click OK and then OK again to continue.

Sending a Digitally Signed Email

With the email certificate installed, you can now begin the process of sending and receiving encrypted emails. However, to complete the process, you need to communicate with someone who also has a certificate to send and receive encrypted emails. Email encryption requires both the sender and the receiver to have valid certificates.

The easiest process for setting up encrypted email communications is to send a user a digitally signed email with a copy of your public key certificate attached. With a digitally signed email and a copy of your public key, the recipient can then add your certificate to his address book, and then he can reply to the message by sending you his public key. After you have exchanged public keys, you can send and receive encrypted emails.

The process for sending a person a digitally signed email with your public key is as follows:

1.
Launch Outlook.

2.
Create a new email by selecting Action | New Mail Message.

3.
Enter the email address of the recipient with whom you want to communicate in the To field, and enter a subject such as Initial Email for Secured Communications.

4.
For the body of the message, you might want to enter the following text: Here is an email message that will help us initiate secured communications. I am attaching a copy of my certificate for you to install; please reply to the message with a copy of your certificate.

Note

Writing a message in the body of the email might not be necessary. However, in this day and age of spam filters, sometimes if you just send a message with your digital signature and an attachment of your public key, the message will be quarantined in the recipient's spam filter. So you are best off writing a few words to describe what you are doing as part of the message.

5.
Click on the Options button and then click on the Security Settings button.

6.
Select the Add Digital Signature to This Message option and then select Send This Message As Clear Text Signed, as shown in Figure 26.

Figure 26. Security properties for sending an initial secured message.

7.
Click on the Change Settings button and make sure the Send These Certificates with Signed Message check box has been selected so that your certificate is sent with the message, and then click OK.

8.
Click OK, and then click Close.

9.
Click Send to send the message.

Your message will now be sent to the recipient with a copy of your key in a digitally signed email message. When the recipient opens the message, he will likely get an error that says, "There are problems with the signature. Click the signature button for details," as shown in Figure 27. This message is displayed because the certificate being received is from a domain that has not communicated in a secured or encrypted manner in the past.

Figure 27. Initial receipt of a digitally signedbut not trustedmessage.

[View full size image]

If the recipient wants to confirm that you indeed sent the message and he can trust your certificate, he should do the following:

1.
Click on the yellow warning icon on the right side of the email message. A notice will appear, as shown in Figure 28.

Figure 28. Certificate of Authority warning.

2.
Click on Trust.

3.
A warning prompt will appear about trusting the sender. Click Yes to accept the trust.

4.
Close and then reopen the email. There should no longer be an error, and the digital signature will be confirmed.

Your certificate has now been installed on the recipient's system, but now he needs to send you his certificate so you can follow the exact same procedures to install his certificate on your system. The recipient should follow the procedure described in "Sending a Digitally Signed Email," with you accepting his message and trusting his certificate.

Sending Encrypted Email Messages

After you have exchanged certificates, you can now send and receive fully encrypted email messages with another individual. To do so, do the following:

1. | Launch Outlook.
2. | Create a new email by selecting Action | New Mail Message.
3. | Enter the email address of the recipient with whom you want to communicate in the To field, and enter a subject such as Encrypted Email Message.
4. | For the body of the message, you might want to enter text such as Here is an email message that should now be encrypted. Please let me know if you successfully receive this message.
5. | Click on the Options button and then click on the Security Settings button.
6. | Select Encrypt Message Contents and Attachments, click OK, and then click Close.
7. | Click Send to send the message.

The recipient will receive an encrypted copy of your message. This process not only works with Microsoft Outlook within an organization, but works the same way when you want to send and receive encrypted messages to individuals outside of your organization. If they are also running Outlook 2003, the process for them to install your certificate into their address book is the same as described previously. If they are using a different email system, they might need to detach the certificate, save it, and manually save the certificate into their address books.


Summary and Other Resources

The goal of this Short Cut was to provide step-by-step procedures that can be followed for the creation of a certificate server, create the appropriate templates and certificates for users, and have certificates automatically issued to users and computers so that a certificate-based encryption system can be easily implemented in an environment.

This Short Cut does not cover the architecture, design, or implementation of certificates in an enterprise environment, nor does it take into account the scalability of global certificate issuance, management, and administration. Now that you know how to create and issue certificates, you can now refer to guides that do reference specific design criteria and distribution methods appropriate for enterprise deploymentshopefully now with a better understanding of how certificate-based encryption, autoenrollment of certificates, and group policybased security management relative to encryption works.

  • The following resources might be helpful in expanding your use of certificates and encryption:

  • Microsoft's Step-by-Step Guide for using Encrypted File System (EFS): http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/efs.mspx

  • Digitally signing and encrypting email messages: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/directory/activedirectory/stepbystep/ncrypte.mspx

  • PKI in a Windows 2003 and Windows XP environment: http://www.microsoft.com/technet/prodtechnol/winxppro/plan/pkienh.mspx

  • Microsoft's Designing and PKI Infrastructure: http://technet2.microsoft.com/WindowsServer/en/Library/b1ee9920-d7ef-4ce5-b63c-3661c72e0f0b1033.mspx?mfr=true

  • Microsoft's Step-by-Step Guide for implementing IPSec in a Windows 2000 environment: http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/ispstep.mspx

  • Microsoft's Best Practice Guide on implementing PKI: http://technet2.microsoft.com/WindowsServer/en/Library/091cda67-79ec-481d-8a96-03e0be7374ed1033.mspx?mfr=true

  • Windows 2003 PKI Operations Guide: http://technet2.microsoft.com/WindowsServer/en/Library/e1d5a892-10e1-417c-be13-99d7147989a91033.mspx?mfr=true

  • Configuring 802.1x wireless encryption: http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/wifisoho.mspx

  • Setting up a certificate of authority: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/xmlsdk/html/29ff74a2-249a-4ecf-8a2a-ff0ba572e4db.asp