Performs installation and configuration of the Active Directory Certificate Services (AD CS) Certification Authority (CA) role service.
Active Directory · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft ADCSDeployment reference: Performs installation and configuration of the Active Directory Certificate Services (AD CS) Certification Authority (CA) role service. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Install-AdcsCertificationAuthority. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / ADCSDeployment · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AllowAdministratorInteraction
Indicates that the cmdlet enables prompting when the private key is accessed. This is not required for any of the Microsoft default providers. For enhanced security components, such as a hardware security module (HSM), review the enhanced security component vendor documentation.
-CACommonName
Specifies the certification authority common name.
-CADistinguishedNameSuffix
Specifies the certification authority distinguished name suffix.
-CAType
Specifies the type of certification authority that this cmdlet installs. The acceptable values for this parameter are: - EnterpriseRootCA - EnterpriseSubordinateCA - StandaloneRootCA - StandaloneSubordinateCA
-CertFile
Specifies the file name of certification authority PKCS #12 formatted certificate file.
-CertFilePassword
Specifies the password for certification authority certificate file.
-CertificateID
Specifies the thumbprint or serial number of certification authority certificate.
-Confirm
Prompts you for confirmation before running the cmdlet.
-Credential
Specifies a PSCredential object for the connection to AD DS. To obtain a credential object, use the Get-Credential cmdlet. For more information, type Get-Help Get-Credential. To install an enterprise certification authority, the computer must be joined to an AD DS domain and a user account that is a member of the Enterprise Admin group is required. To install a standalone certification authority, the computer can be in a workgroup or AD DS domain. If the computer is in a workgroup, a user account that is a member of Administrators is required. If the computer is in an AD DS domain, a user account that is a member of Domain Admins is required.
-CryptoProviderName
Specifies the name of the cryptographic service provider (CSP) or key storage provider (KSP) that is used to generate or store the private key for the CA.
-DatabaseDirectory
Specifies the folder location of the certification authority database.
-Force
Forces the command to run without asking for user confirmation.
-HashAlgorithmName
Specifies the signature hash algorithm used by the certification authority.
-IgnoreUnicode
Indicates that the cmdlet allows Unicode characters in the certification authority name string.
-KeyContainerName
Specifies the name of an existing private key container.
-KeyLength
Specifies the bit length for new certification authority key.
-LogDirectory
Specifies the folder location of the certification authority database log.
-OutputCertRequestFile
Specifies the folder location for the certificate request file.
-OverwriteExistingCAinDS
Indicates that the cmdlet overwrites the computer object in the Active Directory Domain Service domain with the same computer name.
-OverwriteExistingDatabase
Indicates that the cmdlet overwrites the existing certification authority database.
-OverwriteExistingKey
Indicates that the cmdlet overwrites the existing key container with the same name.
-ParentCA
Specifies the configuration string of the parent certification authority that will certify this CA.
-ValidityPeriod
Specifies the validity period of the certification authority (CA) certificate in hours, days, weeks, months, or years. If this is a subordinate CA, do not use this parameter, because the validity period is determined by the parent CA.
-ValidityPeriodUnits
Specifies the validity period of the CA certificate. If this is a subordinate CA, do not specify this parameter because the validity period is determined by the parent CA.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Prerequisites
Windows with the ADCSDeployment module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
Examples
Example 1: Install a new Standalone Root CA with default settings
This command installs a new Standalone Root CA with default settings. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.