Replies: 2 comments 1 reply
-
|
Hello, i can only speculate why Microsoft wrote this, but I assume this is because you can only have one policy module active at a time. Therefore, you would have to replicate the logic from the "Windows Default" policy module, which would be nearly impossible. TameMyCerts solves this be daisy-chaining the "Windows Default" policy module, thus preserving all it's logic. And this approach was taken from a code sample Microsoft published themselves about 10 years ago (which is probably newer than the MSDN article you linked ;)). |
Beta Was this translation helpful? Give feedback.
-
|
Hello @mashdk I found this in the meantime: Quote: So I think we can safely assume that the approach we take is valid. |
Beta Was this translation helpful? Give feedback.
-
|
That's awesome, thank you. |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Very interesting work, you have done here!
You write, that it should only be installed on an Enterprise CA, not a standalone.
However, https://learn.microsoft.com/en-us/windows/win32/seccrypto/policy-modules states:
"An enterprise certification authority should use only the Microsoft-provided enterprise policy module."
I know there's gotta be a perfectly legitimate explanation. But maybe you could help out here?
Beta Was this translation helpful? Give feedback.
All reactions