Credential roaming isn't invoked only at user domain logon but each time one of the following events occurs:
- A user manually enrolls for a certificate by using the MMC Certificates snap-in, the CA Web interface, or the certreq.exe command line utility.
- A user is automatically enrolled for a certificate following a Windows certificate autoenrollment event.
- A user imports a new certificate into the local certificate store.
- A user exports or deletes a certificate from the local certificate store.
- A user unlocks a password protected Windows screensaver.
- GPO settings are refreshed on a user's workstation.
Microsoft leverages the Kerberos protocol and LDAP over SSL (LDAPs)—two key Windows AD security technologies—to both sign and encrypt the DIMS credential data exchanged between the Windows client and the domain controllers (DCs).
Credential roaming isn't enabled by default on a Windows 2003 or Win2K SP3 or later AD installation. It requires the following configuration steps, which I'll explain in more detail in the following sections: . . .
Register
