All posts tagged Active Directory Certificate Services

Windows Server 2016 End of Life January 2027: Plan Your AD CS Migration Now

Happy New Year, everyone! As the calendar rolls over to 2026, it’s time to start planning the migration of workloads hosted on Windows Server 2016. Mainstream support ended for Windows Server 2016 on January 11, 2022, after which it entered extended support. However, extended support for Windows Server 2016 ends on January 12, 2027, at which point it will be end of life and no longer supported. Running production workloads on Windows Server 2016 beyond this date exposes organizations to significant security risk, as it no longer receives security updates, leaving these systems vulnerable to exploits.

Active Directory Certificate Services

Many organizations are still running critical infrastructure on Windows Server 2016. Administrators often delay upgrading Microsoft Active Directory Certificate Services (AD CS) due to its complexity. However, a well-planned AD CS migration not only reduces risk but also provides an opportunity to modernize cryptography, certificate templates, and operational practices.

Certificate Authorities

Administrators must carefully migrate Certificate Authorities (CAs) running on Windows Server 2016 to minimize downtime. In environments where ongoing CA maintenance has been limited, migrating the CA database can be especially challenging. If the CA is installed on a domain controller, now is a good time to consider separating these services to ensure reliable operation. Also, it’s a good idea to evaluate the CA’s configuration and security posture during migration to enhance security and improve service resilience.

NDES Servers

Microsoft Network Device Enrollment Services (NDES) servers, commonly deployed to facilitate certificate enrollment via Microsoft Intune, pose a unique challenge during migration. Unfortunately, configuring NDES is exceedingly complex and error-prone. NDES relies on a delicate combination of specialized IIS configuration, AD service accounts, custom certificate templates, and CA permissions, making even minor changes risky without proper planning. Not surprisingly, administrators are often hesitant to touch these systems as they are notoriously difficult to troubleshoot when problems arise.

Pro Tip: We spend an entire day covering NDES configuration in the Mastering Enterprise PKI Certificates with Microsoft Intune training course. The next session is March 10-12, 2026. Register now!

Intune Certificate Connectors

Don’t overlook Windows Server 2016 servers with the Intune Certificate Connector installed. Fortunately, this is one of the more manageable workloads to migrate. All that’s required is to install new connectors on supported servers and delete the old ones.

Summary

With extended support for Windows Server 2016 ending on January 12, 2027, organizations running production workloads—especially critical infrastructure such as Active Directory Certificate Services (AD CS), Certificate Authorities (CAs), and NDES servers—face significant security risks from unpatched vulnerabilities once the OS reaches end-of-life. Careful migration planning to newer versions such as Windows Server 2022 or 2025 is essential to minimize downtime, improve security posture, and ensure long-term resilience.

Start Planning Now

Don’t leave these mission-critical infrastructure services to the last minute! Begin planning your migration today. If you’d like expert guidance, I have many years of experience migrating these workloads. I have developed specialized tools and techniques to ensure a smooth, secure, and successful transition. Fill out the form below to schedule a free one-hour consultation to assess your Windows Server 2016 AD CS workloads, identify migration risks, and outline next steps.

Additional Information

Windows Server 2016 Lifecycle Policy

PKI Fundamentals with Microsoft Active Directory Certificate Services (AD CS) Online Training Course

Mastering Enterprise PKI Certificates with Microsoft Intune Online Training Course

PKI Fundamentals with Microsoft AD CS Training Course

I’m excited to announce that I’ve partnered once again with the fine folks at the ViaMonstra Online Academy to deliver a new live training course entitled PKI Fundamentals with Microsoft Active Directory Certificate Services (AD CS). The event consists of six weekly live webinars beginning on Thursday, January 15, 2026, at 3:00 PM CST.

Why AD CS Training?

Digital certificates are strong, phishing-resistant credentials that are an excellent choice for authentication to critical workloads like Always On VPN and enterprise Wi-Fi. However, managing certificate services infrastructure can be daunting. This course provides administrators with a fundamental understanding of enterprise PKI with Microsoft AD CS.

Course Overview

The event format for this course consists of six weekly live sessions on Thursdays starting on January 15, 2026. The classes are two hours long, running from 3:00 PM CST to 5:00 PM CST each day. During the course, we’ll cover the following topics.

PKI concepts and certificate use cases
Designing and deploying certificate authorities (CAs)
Configuring templates and enrollment
Managing revocation and maintenance

Who Should Attend

Organizations planning to use certificate authentication for enterprise VPN and Wi-Fi workloads will benefit from this training course. Also, those considering a new AD CS deployment will find this training beneficial. In addition, administrators managing an existing production AD CS environment will gain valuable insight.

Enroll Now

Registration for this training class is available now. The cost is $295.00—an incredible bargain! Don’t miss out on this fantastic opportunity to gain foundational AD CS skills. Click the registration link below and reserve your spot today!

Additional Information

Public Key Infrastructure (PKI)

Enterprise PKI

Cloud PKI for Microsoft Intune

Intune PKCS and SCEP Certificate Validity Period

With the recent announcement of drastically reduced certificate lifetimes for public TLS certificates, there has been much discussion about certificate lifetimes for private certification authorities (CAs) like Microsoft Active Directory Certificate Services (AD CS). Most commonly, AD CS certificates are issued with a one-year validity period. However, as I’ve discussed in the past, there’s good reason to consider shorter lifetimes in many scenarios. Reducing certificate lifetimes is a growing trend to enhance security, but it poses challenges for private CAs like AD CS. This post explains how to manage shorter certificate lifetimes in Intune using PKCS and SCEP.

AD CS Template

With AD CS, the administrator defines the certificate lifetime by setting the validity period value when creating the certificate template in Active Directory (AD), as shown here.

All certificates issued using this template will be valid for one year from the date of issuance.

Note: The only exception would be if the issuing CA’s certificate were due to expire before the one-year expiration date. In that case, the certificate would be valid until the CA certificate expires.

Intune PKCS and SCEP

When issuing certificates with Intune using either PKCS or SCEP, administrators deploy an Intune enrollment certificate template in AD that Intune uses for user and device certificate enrollment. While the Intune enrollment certificate template defines the default validity period, Intune also allows administrators to specify a desired validity period in the PKCS or SCEP policy settings, as shown here.

Intune Validity Period and AD CS

Although Intune provides the ability to define the validity period on the PKCS or SCEP policy, AD CS does not honor this setting unless explicitly configured to do so. Instead, it defaults to the period defined in the certificate template. Using the example above, the administrator defined a validity period of 1 month. However, since the Intune enrollment certificate template’s validity period was set to one year, a certificate valid for one year will be issued.

Override Template Settings

Fortunately, there is a way to override this default behavior. On the issuing CA where the Intune enrollment certificate template is published, open an elevated PowerShell command window and run the following command.

certutil.exe -setreg Policy\EditFlags +EDITF_ATTRIBUTEENDDATE

Once complete, run the following PowerShell command to restart the CA service.

Restart-Service -Name CertSvc -PassThru

After making this change, administrators can define a shorter certificate validity period than specified on the template using Intune PKCS and SCEP policies.

Note: For security reasons, this setting only allows requests that are shorter than the template’s defined validity period. You cannot request a certificate with a validity period that is longer than the template allows.

Summary

By enabling the EDITF_ATTRIBUTEENDDATE flag on your issuing CA, you gain flexibility to tailor certificate validity periods per use case—while still enforcing a maximum validity via the AD Intune certificate enrollment template. Flexible certificate validity periods are especially valuable in environments that are moving toward short-lived certificates for improved security posture.

Additional Information

TLS Certificate Lifetimes Will Officially Reduce to 47 Days

Always On VPN SSTP and 47-Day TLS Certificates

The Case for Short-Lived Certificates in Enterprise Environments

Mastering Certificates with Microsoft Intune – Live Online Training

Richard M. Hicks Consulting, Inc.

Awards

Consulting

Pluralsight

Newsletter

All posts tagged Active Directory Certificate Services

Windows Server 2016 End of Life January 2027: Plan Your AD CS Migration Now