Performs the initial configuration of the Certificate Enrollment Web service.
Active Directory · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft ADCSDeployment reference: Performs the initial configuration of the Certificate Enrollment Web service. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Install-AdcsEnrollmentWebService. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / ADCSDeployment · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AllowKeyBasedRenewal
Indicates that the cmdlet accepts key based renewal requests for the enrollment server, which are valid client certificates for authentication that do not directly map to a security principal.
-ApplicationPoolIdentity
Indicates that the cmdlet configures the Certificate Enrollment Web Service to use the application pool identity when communicating with the Certification Authority (CA). This parameter is only valid when Certificate Enrollment Web Service targets a remote CA. If not specified, the local application pool identity is used. This parameter is only valid when installing the first instance of the Certificate Enrollment Web Service. If this installation will be for an additional instance of Certificate Enrollment Web Service on this server, then this parameter should not be specified.
-AuthenticationType
Specifies the authentication type. The acceptable values for this parameter are: - Certificate - Kerberos - UserName
-CAConfig
Specifies the configuration string of the CA used by the Certificate Enrollment Web Service to process enrollment requests. This parameter depends upon whether a local CA is installed. If the CA is local, then the parameter is optional and defaults to the local CA when not specified. If there is not a local CA, then the parameter is required. The input of the configuration string is \. Replace the computer name of the (CA) for and replace the CA common name for .
-Confirm
Prompts you for confirmation before running the cmdlet.
-Credential
Specifies the credentials for installing the Certificate Enrollment Web Service. To obtain a credential object, use the Get-Credential cmdlet. For more information, type Get-Help Get-Credential. The Certificate Enrollment Web Service must be installed on a server that is a member of an Active Directory Domain Services (AD DS) domain. If the Certificate Enrollment Web Service is configured to use a Standalone certification authority (CA), then an account that is a member of the local Administrators on the CA is required. If the Enrollment Web Service is installed to use an Enterprise CA, then using an account that is a member of Domain Admins group is required.
-Force
Forces the command to run without asking for user confirmation.
-RenewalOnly
Indicates that the cmdlet enables renewal only mode.
-SSLCertThumbprint
Specifies the hash or thumbprint of the Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for a web site as a string value. This parameter is optional. If used, it establishes the necessary binding with Internet Information Server (IIS) to enable support for the required SSL/TLS connectivity. If a binding already exists within IIS, specifying this parameter overwrites the existing binding. If this parameter is not specified, any existing binding is used. If no bindings exist, installation succeeds, but the service will not function until the binding is established manually.
-ServiceAccountName (required)
Specifies the domain account for use with the service. The input string should be in the form of \. For instance, to specify an account named WebEnroll in the Corp.contoso.com domain, you would type CORP\WebEnroll.
-ServiceAccountPassword (required)
Specifies the password for the domain account used as the service account.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Prerequisites
Windows with the ADCSDeployment module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
Examples
Example 1: Installs the Certificate Enrollment Web Service to use the certification authority
Install-AdcsEnrollmentWebService @params
This command installs the Certificate Enrollment Web Service to use the certification authority with a computer name of CA1.contoso.com and a CA common name contoso-CA1-CA. The identity of the Certificate Enrollment Web Service is specified as the default application pool identity. The authentication type is certificate based. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.