We're looking to implement AD CS for SCCM 2012, and I'm getting a lot of conflicting information on how much effort would be needed to implement and maintain AD CS. I'm looking for your experiences with the costs for AD CS. 1. Time/cost to implement AD CS 2. Ongoing / annual time/cost to maintain / admin. Thanks!

You may be getting a lot of conflicting information because SCCM is a very large area, you haven't really given enough information about how much of it you plan to use to give a full answer. Maintaining AD CS provided you have a sensible security policy and the capability to manage your recovery certificates for DR scenarios is not that time intensive. Once you get AD CS up and have auto enrolment configured the rest tends to take care of itself. Like all these things though it will depend on to what extent you use it, if you limit yourself to SCCM then that's one thing, if you subsequently decide you want to roll it out for a wide range of uses then you will have to spend more time. There's an extremely good guide to the configuration using PKI at: http://msandbu.wordpress.com/2012/05/04/sccm-2012-and-pki/ Setup of SCCM is likely to cause you headaches though. From my experience of doing this, I'd say adding PKI to SCCM will nigh on double your initial configuration time, more if you want to deploy OSs directly from SCCM.