Permissions Set on Public Key Services Objects

Permissions listed in this section are set on child objects of the Public Key Services container (cn=Public Key Services, cn=Services, cn=Configuration).

Table B-17: Permissions set on the MachineEnrollmentAgent object (cn=MachineEnrollmentAgent, cn=Certificate Templates, cn=Public Key Services, …)

Account	Allow	Deny	Inherit	Right	On Property
During KMS install
MACHINE$				DS_AM_FULL_CONTROL

Table B-18: Permissions set on the ExchangeUser object (cn=Exchange User, cn=Certificate Templates, cn=Public Key Services, …)

Account	Allow	Deny	Inherit	Right	On Property
During KMS install
MACHINE$				READ_CONTROL | ACTRL_DS_LIST | ACTRL_DS_READ_PROP
MACHINE$				Enroll

Table B-19: Permissions set on the ExchangeUserSignature object (cn=ExchangeUserSignature, cn=Certificate Templates, cn=Public Key Services, …)

Account	Allow	Deny	Inherit	Right	On Property
During KMS install
MACHINE$				READ_CONTROL | ACTRL_DS_LIST | ACTRL_DS_READ_PROP
MACHINE$				Enroll