Latest / The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations / Windows 11 Quietly Mandates Enterprise Certificate Auto-Enrollment
Transcript
- Lucas: So Microsoft is quietly adding a new mandate for Windows 11 Enterprise: certificate auto-enrollment for all domain-joined devices. It's in the latest preview build, and it's going to be required starting with the next feature update. Luna: Certificate auto-enrollment — that's the thing where a machine automatically gets a certificate from Active Directory Certificate Services without an admin having to request one manually? Lucas: Exactly. Right now, many enterprises still rely on Group Policy to push certificates or admins manually request them. This mandate forces every domain-joined Windows 11 device to automatically enroll for a machine certificate from the enterprise's AD CS infrastructure. If you don't have AD CS set up, you'll need to deploy it. Luna: That's a pretty big deal for IT departments that have been putting off their PKI deployment. What's the timeline here? Lucas: The preview build is already out. The mandate will take effect with the Windows 11 2026 Update, which is expected around October. After that, any domain-joined device running that version will automatically attempt to enroll for a certificate. If it can't, you'll see compliance warnings in the Event Log and potentially in Intune if you're using Microsoft's endpoint management. Luna: So what's Microsoft's reasoning? Is this about security or just pushing more cloud integration? Lucas: It's primarily about device identity. Machine certificates let services like VPNs, Wi-Fi using 802.1X, and even some cloud apps verify that the device itself is legitimate, not just the user. Microsoft has been moving toward a zero-trust model where the device is treated as a separate identity from the user. This mandate is a concrete step in that direction. Luna: Right, because if you only authenticate the user, a compromised device can still cause damage. So the machine certificate adds another layer. Lucas: Exactly. And it also simplifies management. Once auto-enrollment is in place, the certificate lifecycle is handled automatically — renewal, revocation, all of it. Admins don't have to track expiration dates manually. Luna: But what about smaller enterprises that don't have a full PKI? Setting up Active Directory Certificate Services isn't trivial. You need a proper CA hierarchy, secure storage for the root key, and ongoing maintenance. Lucas: That's the elephant in the room. Microsoft is essentially forcing a PKI deployment on every domain-joined organization. The good news is that AD CS is included with Windows Server at no extra cost. But you still need the expertise to set it up correctly. If you mess up the root CA, you can compromise the entire certificate chain. Luna: So what about hybrid environments where some devices are domain-joined and some are Azure AD joined? Does this apply to both? Lucas: Good question. The current documentation says this mandate applies only to domain-joined devices. Azure AD joined devices already use cloud-based certificates through Intune or other MDM solutions. So this is really about traditional on-premises or hybrid setups where the device is still joined to an on-prem Active Directory. Luna: That makes sense. But if you're hybrid, you could still have some devices that are domain-joined. And I imagine this will push more organizations to move to Azure AD join to avoid the PKI overhead. Lucas: That's a very likely side effect. Microsoft has been incentivizing cloud-native management for years. This mandate adds one more reason to consider it. But for organizations that are deeply invested in on-prem infrastructure, they'll need to get their certificate services in order. Luna: And if they already have a PKI but only for user certificates? Do they need to reconfigure for machine certificates? Lucas: Yes. The auto-enrollment policy is specifically for machine certificates. You need to configure a certificate template that is suitable for computer authentication — typically the 'Workstation Authentication' template that comes with AD CS. Then you enable auto-enrollment in Group Policy under Computer Configuration > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client – Auto-Enrollment. Set it to 'Renew expired certificates, update pending certificates, and remove revoked certificates' and 'Update certificates that use certificate templates'. Luna: That's pretty straightforward, but it assumes your CA is already properly configured. If you haven't done that, you're looking at a project. Lucas: Right. And there's another gotcha: the auto-enrollment policy applies to the computer account, not the user. So if you've been relying on user certificates for device authentication, that won't cut it anymore. Each machine needs its own certificate. Luna: What about the revocation side? If a device is decommissioned, does the certificate get automatically revoked? Lucas: Not automatically. The auto-enrollment handles renewal, but revocation still requires an admin to manually revoke the certificate or implement a process — for example, using a script that triggers revocation when a computer account is deleted from AD. That's an area where many organizations have gaps. Luna: So this mandate is not just about setting up auto-enrollment; it's about having a full certificate lifecycle management process. Otherwise you end up with a bunch of orphaned certificates that could be misused. Lucas: Exactly. And that's where we see the real benefit — if you do it right, your device identity is much stronger. But it requires discipline. Luna: And if today's tech conversation gave you something usable, listener support is what keeps this show ad-free. If you'd like to help, you can buy me a coffee dot com slash fexingo. Lucas: Yeah, it's a small gesture that makes a big difference for us. No pressure, but it helps us keep going without sponsors. Luna: So back to the certificate mandate — what about Windows 11 Home or Pro? Does this apply to non-Enterprise editions? Lucas: No, the mandate is specifically for Windows 11 Enterprise and Education editions. Home and Pro users won't be forced into auto-enrollment. But if you're in a domain environment, you're likely running Enterprise anyway. Luna: That makes sense. So the impact is primarily on large organizations with on-prem AD. For them, this is a significant change in how they manage device identity. Lucas: And it's worth noting that this is just the latest in a series of quiet mandates. Episode 83 covered TPM 2.0 being mandatory. Episode 70 was about device attestation for VPN. Each one tightens the hardware and identity requirements. Taken together, they paint a picture of Windows 11 as a platform where the device itself is a trusted entity, not just the user. Luna: Right. And for IT admins, that means the compliance burden is shifting. You can't just manage users anymore; you have to manage devices at a granular level. Lucas: And that's ultimately good for security. But it does require upfront investment. The organizations that will struggle are the ones that have been deferring PKI projects. This mandate gives them a firm deadline. Luna: So what's your advice for an IT admin listening right now who hasn't deployed AD CS yet? Lucas: Start planning now. The update is coming in October. Set up a lab environment, configure a two-tier CA hierarchy — offline root CA and an issuing CA. Deploy the workstation authentication template. Test auto-enrollment on a few pilot machines. And make sure you have a revocation process in place. If you wait until the update hits, you'll be scrambling. Luna: And for those who already have AD CS but only for user certs, they need to add the machine certificate template and enable auto-enrollment via Group Policy. That's a relatively quick win. Lucas: Exactly. And once it's set up, it runs itself. That's the beauty of auto-enrollment — it reduces admin overhead in the long run. But the initial setup is critical. Luna: Well, that's a clear call to action. We'll be watching to see how many organizations are ready by October. Lucas: Absolutely. And as always, we'll keep you updated on any changes or clarifications from Microsoft. This is one to watch.