Provision to Microsoft Windows (PowerShell)

1. Sign in to Next-Gen Trust Security.
2. Click Insights > Machines.
3. Select the Microsoft Windows (PowerShell) machine you want to provision a certificate to.
4. Click Provision a certificate.
5. From Choose a certificate from the inventory, search for and select the certificate you want to provision.
   Verify that you selected the correct certificate by reviewing the Subject DN, Validity, and Fingerprint.
6. From CAPI Store, select the certificate store where the certificate will be installed.
7. Enter a Friendly Name for the certificate in the Windows certificate store.
8. (Optional) Enable Allow private key to be exported if the private key must be exportable.
9. (Optional) To invoke a PowerShell script after certificate installation, enable Installation Endpoint.
   Note: When enabled, Next-Gen Trust Security executes the configured PowerShell script using the credentials associated with the machine. The script can consume the provisioned certificate (for example, bind it to a Windows service).
   The script must implement a function named bind-certificate with the following parameters:
   • certificateStore (string)
   • thumbprint (string)
   A successful execution must return exit code 0. A non-zero exit code indicates failure and is reported in Next-Gen Trust Security.
   Example:

   function bind-certificate([string]$certificateStore, [string]$thumbprint)
   {
       return 0
   }

10. In Script Path, enter the full path to the PowerShell script.
11. (Optional) To create the certificate record without pushing it, set Push upon saving to No.
    When set to Yes (default), saving installs the certificate in the CAPI store. If Installation Endpoint is enabled, the script is also executed.
12. Click Save.