Hello all. I facing the following problem. Let me explain you our structure. One root Domain and one Child domain. My users belong to the to the child domain and my servers (CA for example) belong to the root domain and through autoenroll users request/generate certificates without any problem, but we realize that the certificates can not published on the ch. domain because the CA it was not belong to the group Cert Publishers (i fix that and its working correct). So my problem is.... all the users have already generated certificates without this certs published to the child domain.. in order my s/mime to work i have re issue new certificates... is there any way all the issued certificates to published to the AD?

One way is to have the users use the Publish to GAL button in outlook. This will publish the Email Encryption certificate to the user's userCertificate attribute (and the User SMIMECertificate attribute if memory serves me correct). Brian

You can also use the certutil command. Assuming that Bob Smith's SMIME encryption certificate is in the file C:\Users\Bob\BobEncrypt.crt certutil -dspublish c:\users\bob\bobencryt.crt CN=Bob Smith,OU=Employees,DC=example,DC=com?userCertificate Where you would change the LDAP path to match the path of the user object. This could be done centrally since you can export the certificate for each user (for only the SMIME encryption certificate template) at the CA. Brian

Hello Brian and thanks for your reply. Since my users are more 1000 is there any way to do this for all users massive...?? for example send a script to all of them? or direct from the ca (massive)? or another way?? dkotix

The second option would be your only way that I know of Brian