Training Guide Configuring Advanced Windows Server 2012 R2 Services(2014)

---

7. Switch to SYD-DC as contoso\don_funk with the password Pa$$w0rd.

8. In the Certification Authority console, click Contoso-SYD-DC-CA, and on the Action menu, click Properties.

9. On the Extensions tab, ensure that CRL Distribution Point (CDP) is selected as shown in Figure 4-46, and click Add.

FIGURE 4-46 Verify the CRL Distribution Point (CDP) is selected on the Extensions tab

10. In the Add Location dialog box, type file://mel-dc/alt_cdp/.

11. Ensure that <CaName> is selected as a Variable and click Insert.

12. Ensure that <CRLNameSuffix> is selected as a Variable and click Insert.

13. Ensure that <DeltaCRLAllowed> is selected as a Variable and click Insert

14. Append the location with .crl as shown in Figure 4-47 and click OK.

FIGURE 4-47 Append the location with CRL

15. On the Extensions tab, select the following options as shown in Figure 4-48 and click OK.

Publish CRLs To This Location.

Include In CRLs. Clients Use This To Find Delta CRL Locations.

Include In The CDP Extension Of Issued Certificates.

Publish Delta CRLs To This Location.

FIGURE 4-48 Select Extension options

16. When prompted to restart the Certification Authority, click Yes.

17. In the Certification Authority console, click the Revoked Certificates node. On the Action menu, click All Tasks and then click Publish.

18. On the Publish CRL dialog box, select New CRL as shown in Figure 4-49 and click OK.

FIGURE 4-49 Select the New CRL option

19. In the Search charm, type \\MEL-DC\ALT-CDP and verify that two files are present as shown in Figure 4-50.

FIGURE 4-50 Verify CA files

Exercise 6: Configure an Online Responder

In this exercise, you configure an Online Responder. To complete this exercise, perform the following steps:

1. On SYD-DC, while signed on as contoso\don_funk, switch to the Certification Authority console.

2. In the Certification Authority console, expand Contoso-SYD-DC-CA and click Certificate Templates.

3. On the Action menu, click Manage.

4. In the Certificate Template console, right-click OCSP Response Signing, and then click Properties.

5. On the Security tab of the OCSP Response Signing Properties dialog box, click Add.

6. In the Select Users, Computers, Service Accounts, Or Groups dialog box, click Object Types, select Computers, click OK, type SYD-DC, click Check Names, and then click OK.

7. On the Security tab of the OCSP Response Signing Properties dialog box, set the permissions for SYD-DC$ to Read (Allow), Enroll (Allow), and Autoenroll (Allow) as shown in Figure 4-51. Click OK.

FIGURE 4-51 Set SYD-DC$ permissions

8. Close the Certificate Templates console.

9. In the Certification Authority console, expand Contoso-SYD-DC-CA and click Certificate Templates.

10. On the Action menu, click New, and click Certificate Template To Issue.

11. On the Enable Certificate Templates dialog box, click OCSP Response Signing as shown in Figure 4-52 and click OK.

FIGURE 4-52 Click OCSP Response Signing

12. Click Add Roles And Features on the Manage menu of the Server Manager console.

13. On the Before You Begin page of the Add Roles And Features Wizard, click Next three times.

14. On the Select Server Roles page, expand the Active Directory Certificate Services (Installed) node and click Online Responder as shown in Figure 4-53.

FIGURE 4-53 Click Online Responder

15. On the Add Features That Are Required For Online Responder dialog box, click Add Features, and then click Next twice.

16. On the Confirm Installation Selections page, click Install.

17. When the installation completes, click Close.

18. Click the Notifications menu and then click Configure Active Directory Certificate Services on the Destination Server.

19. On the Credentials page, ensure that CONTOSO\don_funk is selected and then click Next.

20. On the Role Services page, select Online Responder as shown in Figure 4-54, and then click Next.

FIGURE 4-54 Select Online Responder

21. On the Confirmation page, click Configure.

22. On the Results page, click Close.

23. On the Tools menu of the Server Manager console, click OCSP Responder.

24. In the OCSP console, click Revocation Configuration. In the Actions pane, click Add Revocation Configuration.

25. On the Getting Started With Adding A Revocation Configuration page of the Add Revocation Configuration Wizard, click Next.

26. On the Name The Revocation Configuration page, type the name Contoso_OCSP and click Next.

27. On the Select CA Certificate Location page, click Select A Certificate For An Existing Enterprise CA as shown in Figure 4-55, and click Next.

FIGURE 4-55 Select A Certificate For An Existing Enterprise CA location

28. In the Select Certification Authority dialog box, click Contoso-SYD-DC-CA and click OK.

29. On the Choose CA Certificate page, click Next.

30. On the Select Signing Certificate page, select Auto-Enroll For An OCSP Signing Certificate, click Browse, click Contoso-SYD-DC-CA, and click OK. Verify that the Select Signing Certificate page matches Figure 4-56, and then click Next.

FIGURE 4-56 Autoenroll for an OCSP signing certificate

31. On the Revocation Provider page, click Provider.

32. Verify that the provider is configured as shown in Figure 4-57, click OK and click Finish.

FIGURE 4-57 Configure the Revocation Provider page

33. Verify in the OCSP console that the Revocation Configuration Status is set to Working as shown in Figure 4-58.

FIGURE 4-58 Check the Revocation Configuration Status

34. In the Certification Authority console, right-click Contoso-SYD-DC-CA and click Properties.

35. On the Extensions tab of the Contoso-SYD-DC-CA Properties dialog box, set the Extension drop-down menu to Authority Information Access (AIA) and click Add.

36. In the Location text box, type http://syd-dc.contoso.com/ocsp and click OK.

37. On the Extensions tab of the Contoso-SYD-DC-CA Properties dialog box, click http://syd-dc.contoso.com/ocsp, select Include In The Online Certificate Status Protocol (OCSP) Extension as shown in Figure 4-59, and click OK.

FIGURE 4-59 Set certificate locations

38. When prompted to restart certificate services, click Yes.

Exercise 7: Configure administrative role separation

In this exercise, you configure administrative role separation by delegating different certificate services permissions to different security groups. To complete this exercise, perform the following steps:

1. When signed on to SYD-DC as contoso\don_funk, click Active Directory Administrative Center on the Tools menu of the Server Manager console.

2. In Active Directory Administrative Center, click the Contoso (Local) node and then click the Users container.

3. In the Tasks menu, click New, and click Group.

4. In the Create Group dialog box, type the name Certificate_Managers, ensuring that the group type is set to Security and the Group Scope is set to Global as shown in Figure 4-60, and click OK.

FIGURE 4-60 Set Security and Global group types

5. In the Tasks menu, click New and click Group.

6. In the Create Group dialog box, type the name CertAuthority_Admins, ensuring that the group type is set to Security, and the Group Scope is set to Global. Click OK.

7. In the Certification Authority console, click Contoso-SYD-DC-CA and in the Action menu click Properties.

8. On the Security tab of the Contoso-SYD-DC-CA Properties dialog box, click Add.

9. On the Select Users, Computers, Service Accounts, Or Groups dialog box, type Certificate_Managers; CertAuthority_Admins as shown in Figure 4-61 and click OK.

FIGURE 4-61 Type Certificate_Managers; CertAuthority_Admins

10. On the Security tab, click CertAuthority_Admins (CONTOSO\CertAuthority_Admins) and configure permissions so that only the Manage CA (Allow) permission is selected as shown in Figure 4-62. Click Apply.

FIGURE 4-62 Configure security permissions

11. On the Security tab, click Certificate_Managers (CONTOSO\Certificate_Managers) and configure permissions so that only the Issue And Manage Certificates (Allow) permission is selected as shown in Figure 4-63 and click Apply.

FIGURE 4-63 Select the Issue And Manage Certificates (Allow) permission

12. On the Certificate Managers tab, click Restrict Certificate Managers as shown in Figure 4-64 and click OK.

FIGURE 4-64 Click Restrict Certificate Managers

Exercise 8: Configure a key recovery agent certificate template

In this exercise, you configure a key recovery agent certificate. To complete this exercise, perform the following steps:

1. On SYD-DC while signed in as contoso\don_funk, open the Certification Authority console.

2. In the Certification Authority console, click Certificate Templates. On the Action menu, click Manage to open the Certificate Templates console.

3. In the Certificate Templates console, click the Key Recovery Agent template. On the Action menu, click Duplicate Template.

4. On the Compatibility tab of the Properties Of New Template dialog box, set the Certification Authority to Windows Server 2012 R2.

5. On the Resulting Changes dialog box, click OK.

6. On the Compatibility tab of the Properties Of New Template dialog box, set the Certificate Recipient to Windows 8.1 / Windows Server 2012 R2 as shown in Figure 4-65.

FIGURE 4-65 Set the Certificate Recipient to Windows 8.1 / Windows Server 2012 R2

7. On the Resulting Changes dialog box, shown in Figure 4-66, click OK.

FIGURE 4-66 The Resulting Changes dialog box

8. On the General tab, set the Template Display Name to New Key Recovery Agent and the template name to NewKeyRecoveryAgent. Select the Publish Certificate In Active Directory option as shown in Figure 4-67 and click Apply.

FIGURE 4-67 The Publish Certificate In Active Directory option

9. On the Superseded Templates tab, click Add.

10. In the Add Superseded Template dialog box, click Key Recovery Agent, and click OK.

11. On the Superseded Templates tab, verify that Key Recovery Agent is listed as shown in Figure 4-68, and click Apply.

FIGURE 4-68 The Key Recovery Agent

12. On the Security tab, ensure that Domain Admins (CONTOSO\Domain Admins) has the Read (Allow), Write (Allow), and Enroll (Allow) permissions as shown in Figure 4-69 and then click OK.

FIGURE 4-69 Ensure that the Domain Admins (CONTOSO\Domain Admins) has the Read (Allow), Write (Allow), and Enroll (Allow) permissions set

13. Close the Certificate Templates console.

14. In the Certification Authority console, click Certificate Templates.

15. On the Action menu, click New and click Certificate Template To Issue.

16. On the Enable Certificate Templates dialog box, click New Key Recovery Agent as shown in Figure 4-70 and click OK.

FIGURE 4-70 Click New Key Recovery Agent

17. In the Certification Authority console, refresh the list of Certificate Templates and verify that the New Key Recovery Agent template is visible, as shown in Figure 4-71.

FIGURE 4-71 Verify that the New Key Recovery Agent template is visible

Exercise 9: Request a key recovery agent certificate

In this exercise, you create a user account to be used as a key recovery agent. To complete this exercise, perform the following steps:

1. When signed on to SYD-DC as contoso\don_funk, click Active Directory Users And Computers on the Tools menu of the Server Manager console.

2. In the Users container, click Don Funk. In the Action menu, click Copy.

3. On the Copy Object – User dialog box, enter the following information as shown in Figure 4-72 and click Next:

Full Name: Keymaster

User Logon Name: keymaster

FIGURE 4-72 Fill out the Copy Object - User dialog box

4. Enter the password Pa$$w0rd twice. Ensure that only Password Never Expires is selected, click Next, and click Finish.

5. Sign off SYD-DC and sign on as contoso\keymaster with the password Pa$$w0rd.

6. In the Search charm, type MMC. Click Mmc in the list of results.

7. On the User Account Control dialog box, click Yes.

8. On the File menu of the Console1 window, click Add/Remove Snap-In.

9. On the Add Or Remove Snap-Ins dialog box, click Certificates as shown in Figure 4-73 and click Add.

FIGURE 4-73 Click Certificates in the Add Or Remove Snap-Ins dialog box

10. In the Certificates Snap-In dialog box, click My User Account, click Finish, and click OK.

11. In Console1, expand Certificates – Current User and click the Personal node.

12. On the Action menu, click All Tasks and click Request New Certificate.

13. On the Before You Begin page of the Certificate Enrollment Wizard, click Next twice.

14. On the Request Certificates page, select New Key Recovery Agent as shown in Figure 4-74, click Enroll, and click Finish.

FIGURE 4-74 Select New Key Recovery Agent on the Request Certificates page

15. On the Tools menu of the Server Manager console, click Certification Authority.

16. In the Certification Authority console, expand the Contoso-SYD-DC-CA node and click the Pending Requests node.

17. Click the certificate request listed as shown in Figure 4-75. On the Action menu, click All Tasks and click Issue.

FIGURE 4-75 Pending requests on the Certification Authority

18. Switch back to Console1 and expand the Active Directory User Object node, click the Certificates node, and double-click the certificate listed.

19. Verify that the certificate is intended for the purpose of Key Recovery Agent as shown in Figure 4-76 and click OK.

FIGURE 4-76 Verify the certificate

20. Sign off SYD-DC and sign back on as contoso\don_funk with the password Pa$$w0rd.

Exercise 10: Configure key recovery

In this exercise, you configure key recovery on SYD-DC. To complete this exercise, perform the following steps:

1. While signed on to SYD-DC as contoso\don_funk, open the Certification Authority console from the Tools menu of the Server Manager console.

2. In the Certification Authority console, click Contoso-SYD-DC-CA. In the Action menu, click Properties.

3. On the Recovery Agents tab of the Contoso-SYD-DC-CA Properties dialog box, click Archive The Key and click Add.

4. In the Key Recovery Agent Selection dialog box, click Keymaster as shown in Figure 4-77 and click OK.

FIGURE 4-77 Select Keymaster in the Key Recovery Agent Selection dialog box

5. On the Contoso-SYD-DC-CA Properties dialog box, click Apply.

6. When prompted to restart Active Directory Certificate Services, click Yes.

7. After Active Directory Certificate Services has restarted, on the Recovery Agents tab, verify that the Keymaster Key Recovery Agent Certificate has the status of Valid as shown in Figure 4-78.

FIGURE 4-78 Verify that the Keymaster Key Recovery Agent Certificate has the status of Valid

8. Click OK to close the Contoso-SYD-DC-CA Properties dialog box.

Exercise 11: Configure a certificate template for autoenrollment and key recovery

In this exercise, you configure a certificate so that it can be configured for automatic enrollment and certificate recovery. To complete this exercise, perform the following steps:

1. On SYD-DC when signed on as contoso\don_funk, switch to the Certification Authority console and click the Certificate Templates node.

2. On the Action menu, click Manage.

3. In the Certificate Templates console, click the Basic EFS template. On the Action menu, click Duplicate Template.

4. On the Compatibility tab of the Properties Of New Template dialog box, set the Certification Authority drop-menu down to Windows Server 2012 R2.

5. On the Resulting Changes dialog box, click OK.

6. On the Compatibility tab, set the Certificate Recipient to Windows 8.1 / Windows Server 2012 R2.

7. On the Resulting Changes dialog box, click OK.

8. Verify that the Properties Of New Template dialog box matches Figure 4-79 and click the General tab.

FIGURE 4-79 Verify that the Properties Of New Template dialog box matches

9. On the General tab, set the following properties as shown in Figure 4-80 and click Apply:

Template Display Name: Advanced EFS

Template Name: AdvancedEFS

Publish Certificate in Active Directory: Enabled

FIGURE 4-80 Set properties on the General tab

10. On the Security tab, click Authenticated Users and assign them the Enroll (Allow) and Autoenroll (Allow) permissions and retain the Read (Allow) permission as shown in Figure 4-81. Click OK.

FIGURE 4-81 Click Authenticated Users and assign them the Enroll (Allow) and Autoenroll (Allow) permissions as well as retain the Read (Allow) permission

11. Close the Certificate Templates console.

12. On the Certification Authority console, click the Certificate Templates node. On the Action menu, click New and click Certificate Template To Issue.

13. On the Enable Certificate Templates dialog box, click Advanced EFS as shown in Figure 4-82 and click OK.

FIGURE 4-82 Clicking Advanced EFS

14. Verify that the Advanced EFS template is listed when the Certificate Templates node of the Certification Authority console is selected as shown in Figure 4-83.

FIGURE 4-83 Verify that the Advanced EFS template is listed when the Certificate Templates node of the Certification Authority console is selected

Exercise 12: Configure Group Policy to support autoenrollment, credential roaming, and automatic renewal

In this exercise, you configure the default domain policy to support autoenrollment and automatic certificate renewal. To complete this exercise, perform the following steps:

1. On SYD-DC when signed in as contoso\don_funk, click Group Policy Management on the Tools menu of the Server Manager console.

2. In the Group Policy Management console, expand Forest: Contoso.com, expand Domains, expand Contoso.com, and click Default Domain Policy.

3. On the Group Policy Management Console dialog box, click OK.

4. On the Action menu, click Edit.

5. In the Group Policy Management Editor, expand User Configuration\Policies\Windows Settings\Security Settings and click the Public Key Policies node as shown in Figure 4-84.

FIGURE 4-84 Expand User Configuration\Policies\Windows Settings\Security Settings and click the Public Key Policies node

6. Click the Certificate Services Client – Auto-Enrollment policy. On the Action menu, click Properties.

7. Set the Configuration Model drop-down menu to Enabled.

8. Select the following options as shown in Figure 4-85 and click OK.

FIGURE 4-85 Configuring the CA Enrollment Policy

Renew Expired Certificates, Update Pending Certificates, And Remove Revoked Certificates.

Update Certificates That Use Certificate Templates.

9. In the Group Policy Management Editor, click the Certificate Services Client – Certificate Enrollment Policy item. On the Action menu, click Properties.

10. On the Certificate Services Client – Certificate Enrollment Policy dialog box, set the Configuration Model to Enabled and ensure that Active Directory Enrollment Policy is selected as shown in Figure 4-86. Click OK.

FIGURE 4-86 Set the Configuration Model to Enabled and ensure that the Active Directory Enrollment Policy is selected

11. In the Group Policy Management Editor, click the Certificate Services Client – Credential Roaming policy. On the Action menu, click Properties.

12. On the Certificate Services Client – Credential Roaming Properties dialog box, click Enabled as shown in Figure 4-87 and click OK.

FIGURE 4-87 Enable the Certificate Services Client – Credential Roaming Properties dialog box

13. Click OK on the Changing RUP Exclusion List dialog box, close the Group Policy Management Editor, and then close the Group Policy Management console.

14. Click the Windows PowerShell icon on the taskbar.

15. In the Windows PowerShell window, type the following command and press Enter:

Gpupdate /force

16. Close the Windows PowerShell window when both policies have updated.

17. In the Certification Authority console, click the Issued Certificates node.

18. Verify that a certificate using the Advanced EFS template has been issued to CONTOSO\don_funk as shown in Figure 4-88.

FIGURE 4-88 Verify that a certificate using the Advanced EFS template has been issued to CONTOSO\don_funk

Exercise 13: Configure a certificate template to support private key archival and recovery and reenroll all certificate holders

In this exercise, you modify the properties of the Advanced EFS template so that the private key is automatically archived and then reenroll all certificate holders. To complete this exercise, perform the following steps:

1. On SYD-DC when signed in as contoso\don_funk, select the Certificate Templates node of the Certification Authority console. On the Action menu, click Manage.

2. In the Certificate Templates console, click the Advanced EFS template. In the Action menu, click Properties.

3. On the Request Handling tab of the Advanced EFS Properties dialog box, select Archive Subject’s Encryption Private Key.

4. On the Changing Key Archival Property dialog box, click OK.

5. Ensure that the Request Handling tab of the Advanced EFS Properties dialog box is configured as shown in Figure 4-89 and click OK.

FIGURE 4-89 Ensure that the Request Handling tab of the Advanced EFS Properties dialog box is configured

6. Click the Advanced EFS template and on the Action menu click Reenroll All Certificate Holders.

7. Open a Windows PowerShell window by clicking the Windows PowerShell icon on the taskbar.

8. In the Windows PowerShell window, type the following command and press Enter:

9. Gpupdate /force

10. Switch to the Certificate Authority console and select the Issued Certificates node.

11. Verify that a new certificate using the Advanced EFS certificate template has been issued to CONTOSO\don_funk as shown in Figure 4-90.

FIGURE 4-90 Use the Advanced EFS certificate template

Exercise 14: Perform certificate revocation

In this exercise, you revoke the certificate issued to the subordinate CA hosted on ADL-DC. You would do this if the computer hosting the CA had been compromised by malware and might have been exploited by nefarious third parties. To complete this exercise, perform the following steps:

1. On SYD-DC when signed in as CONTOSO\don_funk, open the Certification Authority console and select the Issued Certificates node.

2. Select the second certificate issued or the one with the higher number in the Request ID column that uses the Subordinate Certification Authority template.

3. On the Action menu, click Open and verify that this certificate has been issued to Contoso-ADL-DC-CA as shown in Figure 4-91. Click OK to close the Certificate Properties dialog box.

FIGURE 4-91 Certificate information

4. With the correct certificate selected, click All Tasks on the Action menu and then click Revoke Certificate.

5. In the Certificate Revocation dialog box, choose Certificate Hold as the reason for the certificate revocation as shown in Figure 4-92 and click Yes.

FIGURE 4-92 The Certificate Revocation dialog box

6. In the Certification Authority console, click the Revoked Certificates node and verify that the certificate is listed with the Revocation Reason set to Certificate Hold as shown in Figure 4-93.

FIGURE 4-93 Verify that the certificate is listed

7. Ensure that the Revoked Certificates node is selected. On the Action menu, click All Tasks and click Publish.

8. In the Publish CRL dialog box, click New CRL as shown in Figure 4-94 and then click OK.

FIGURE 4-94 Select New CRL in the Publish CRL dialog box

9. Switch to ADL-DC and sign in as contoso\don_funk with the password Pa$$w0rd.

10. On the Taskbar, click the Windows PowerShell icon.

11. In the Windows PowerShell window, type the following commands and press Enter after each command:

Gpupdate /force

Certutil –urlcache crl delete

Certutil –urlcache ocsp delete

12. On the Tools menu of the Server Manager console, click Certification Authority.

13. In the Certification Authority console, click the Contoso-ADL-DC-CA node.

14. On the Action menu, click Properties.

15. On the General tab of the Contoso-ADL-DC-CA Properties dialog box, click View Certificate.

16. Verify that the certificate is listed as revoked, as shown in Figure 4-95, and click OK twice.

FIGURE 4-95 Verify that the certificate is listed as revoked

Exercise 15: Perform certificate recovery

In this exercise, you delete the Advanced EFS certificate that has been assigned to Don Funk and then use the keymaster user account to perform key recovery. To complete this exercise, perform the following steps:

1. When signed on to SYD-DC as contoso\don_funk, type mmc.exe in the Search charm and click Mmc in the list of results.

2. On the User Account Control dialog box, click Yes.

3. On the File menu of the Console1 console, click Add/Remove Snap-In.

4. On the Add Or Remove Snap-Ins dialog box, click Certificates and click Add.

5. On the Certificates Snap-In dialog box, click My User Account as shown in Figure 4-96, click Finish, and then click OK.

FIGURE 4-96 The Certificates Snap-In dialog box

6. In the Console1 console, expand the Certificates – Current User\Personal\Certificates node and click the certificate with the intended purpose listed as Encrypting File System as shown in Figure 4-97.

FIGURE 4-97 Click the certificate with the intended purpose of the Encrypting File System

7. On the Action menu, click Delete.

8. On the Certificates dialog box, click Yes.

9. On the File menu, click Save. Save the console on the desktop as console1.msc.

10. Sign off SYD-DC and sign on as contoso\keymaster with the password Pa$$w0rd.

11. On the Tools menu of the Server Manager console, click Certification Authority.

12. On the Certification Authority console, expand Contoso-SYD-DC-CA and click the Issued Certificates node.

13. Click the most recently issued certificate to CONTOSO\don_funk that uses the Advanced EFS certificate template as shown in Figure 4-98.

FIGURE 4-98 Click the most recently issued certificate to CONTOSO\don_funk that uses the Advanced EFS certificate template

14. On the Action menu, click Open.

15. On the Details tab of the Certificate dialog box, highlight the Serial Number as shown in Figure 4-99.

FIGURE 4-99 Highlighting the Serial Number on the Details pane of the Certificate dialog box

16. While the text is highlighted, press Ctrl+C to copy the text.

17. On the Search charm, type Notepad and then click Notepad in the results pane.

18. On the Edit menu of Notepad, click Paste.

19. In Notepad, remove all of the spaces in the serial number so that it appears in a manner similar to that of Figure 4-100.

FIGURE 4-100 Remove all of the spaces in the serial number in Notepad

20. In Notepad, select the serial number on the Edit menu, and then click Copy.

21. Open an elevated Windows PowerShell window and type the following command where <serial number> is the pasted serial number from Notepad as shown in Figure 4-101:

Certutil –getkey <serial number> outputblob

FIGURE 4-101 An elevated Windows PowerShell window

22. Type the following command and press Enter to convert the outputblob to a PFX file. Type the password Pa$$w0rd when prompted as shown in Figure 4-102.

Certutil –recoverkey outputblob c:\don-recovery.pfx

FIGURE 4-102 Convert the outputblob to a PFX file

23. Sign off and sign back on to SYD-DC as contoso\don_funk.

24. Click the File Explorer icon on the taskbar and navigate to Local Disk (C:).

25. Double-click the Don-recovery file.

26. On the Welcome To The Certificate Import Wizard page of the Certificate Import Wizard, click Current User and then click Next twice.

27. On the Private Key Protection page, enter the password Pa$$w0rd as shown in Figure 4-103, click Next twice, click Finish, and then click OK.

FIGURE 4-103 Enter the password on the Private Key Protection page

28. On the Desktop, double-click Console1. Click Yes on the User Account Control dialog box.

29. Verify that the certificate has been recovered.