An access control entry grants controls which Active Directory groups can or cannot enroll certificates for a specific Connector for AD template. When you can create or manage groups and permissions in Connector for AD, you must provide the Security identifier (SID) of the group object from Active Directory. You can obtain the SID using the following PowerShell command. For information about SIDs, see How security identifiers work
$Get-ADGroup -Identity "my_active_directory_group_name"
The following procedures illustrate how to create and manage Connector for AD template access group entries.
To manage template group permissions using the console
You can manage groups and permissions for an existing template can be managed from a template's details page. For more information, see View connector template details.
Set permissions on which groups can or cannot enroll certificates for the specific template. You provide the security identifier (SID) of the group. Then you set the enroll and auto-enroll permissions for the group. For auto-enrollment, both enroll and auto-enroll must be set to "Allow."
