I want to create an enrollment certificate that can be used by our Helpdesk staff to enroll users on their behalf for mobile device access to our wifi network. Our CA is hosted on Server 2008, and we would be using the Certificates MMC on the CA to do this (unless it's possible via Web Enrollment?). Any idea's how to go about this?

To enable Enroll on behalf off scenario, you need the following: A user (the helpdesk staff) with an Enrollment Agent certificate, you can use the built in Enrollment Agent template or a customized copy A certificate template that requires Authorized Signatures http://technet.microsoft.com/en-us/library/cc759203(WS.10).aspx Whenever you have the above you can use MMC to enroll for certificates on behalf of other users http://technet.microsoft.com/en-us/library/cc770802.aspx Additionally it is recommended to configure and use Restricted Enrollment Agent http://technet.microsoft.com/en-us/library/cc753800(WS.10).aspx /Hasain

To enable Enroll on behalf off scenario, you need the following: A user (the helpdesk staff) with an Enrollment Agent certificate, you can use the built in Enrollment Agent template or a customized copy A certificate template that requires Authorized Signatures http://technet.microsoft.com/en-us/library/cc759203(WS.10).aspx Whenever you have the above you can use MMC to enroll for certificates on behalf of other users http://technet.microsoft.com/en-us/library/cc770802.aspx Additionally it is recommended to configure and use Restricted Enrollment Agent http://technet.microsoft.com/en-us/library/cc753800(WS.10).aspx /Hasain