Step 3: Installing the Jamf AD CS Connector for Outbound Communication Mode

To integrate Jamf Pro with AD CS, you must install the Jamf AD CS Connector on a Windows server. The connector runs as a service that allows Jamf Pro to communicate with the AD CS certificate authority server.

Note:

PowerShell has a security setting that does not allow the execution of scripts if they are not digitally signed. You can get the setting by executing the following command from the PowerShell prompt:

Get-ExecutionPolicy

If the returned value is RemoteSigned, scripts must be signed before they can be run. You can temporarily change this setting by executing the following command:

Set-ExecutionPolicy unrestricted

Log in to the Windows server that will host the Jamf AD CS Connector as a user with administrator privileges.
Click the following link to the Products area of Jamf Account, and then click Download: https://account.jamf.com/products/other/ad-cs-connector/download.
Extract the downloaded file.
Open a PowerShell console as an administrator and change the directory to the unzipped "ADCS Connector" folder (e.g., C:\Users\administrator\Downloads\adcs-connector-x.x.x\ADCS Connector).

View the configuration options by running the following command:

# display outbound connector installation options 
.\install-adcs-connector.ps1 -outbound -help

Review the necessary configuration parameters and defaults and determine any necessary configuration changes. It is not recommended to modify the polling or publish batch sizes or intervals.


Parameter	Description	Default Value
`clientId`	The API client ID intended to be used with the AD CS connection which was determined in a preceding step	N/A
`clientSecret`	The API client secret associated with the client ID which was determined in a preceding step	N/A
`jamfProUrl`	The URL of your Jamf Pro server	N/A
`adcsId`	The ID associated with the specific AD CS integration which was determined in preceding step	N/A
`pollingInterval`	Request polling interval in seconds	10 seconds
`jobBatchSize`	Request job batch size	100 certificate requests
`publishInterval`	Results publishing interval back to Jamf Pro in seconds	3 seconds
`publishBatchSize`	Results publishing batch size back to Jamf Pro	100 certificates
`outboundDirBase`	Base directory for installation	${env:programfiles(x86)}\adcs-connector\outbound
`serviceDisplayName`	Display name for the service	AdcsConnectorOutbound

Note:

If you want to run the Jamf AD CS Connector as a service user (e.g., for a regular service account or a group managed service account), do the following:

Provide the -serviceUser property with your user in DOMAIN\userName format.
If your service user requires a password, provide it using the -servicePassword parameter.
Provide your service user with filesystem read/write access to the following directories:
- %PROGRAMDATA%\Jamf\AdcsConnector\Logs\Jamf-ADCS-Connector\AdcsConnectorOutbound_.log—This is the log file location.
- C:\Program Files (x86)\adcs-connector (or the value supplied for outboundDirBase if you are not using the default)

Run the install-adcs-connector.ps1 PowerShell script, including any custom parameter values that you determined in the preceding steps.
The following example shows the minimum required parameters needed to run the installation script:
```
# install the outbound connector 
.\install-adcs-connector.ps1 -outbound -install -clientId API_client_ID -clientSecret API_client_secret -jamfProUrl JAMF_PRO_URL -adcsId adcsid
```
The completed example below uses the following values:
- clientId: adf5ba29-f805-4bd1-862f-1b8b19e02071
- clientSecret: tCaxEHWGq9OYXsje0nDUBZlChnSJxRie-EeML2l4iFNkik5ENAJNWszMXwm8BgMs
- jamfProURL: https://jamf_pro_url.jamfcloud.com/
- adcsId: 3
```
# install the outbound connector 
.\install-adcs-connector.ps1 -outbound -install -clientId adf5ba29-f805-4bd1-862f-1b8b19e02071 -clientSecret tCaxEHWGq9OYXsje0nDUBZlChnSJxRie-EeML2l4iFNkik5ENAJNWszMXwm8BgMs -jamfProUrl https://jamf_pro_url.jamfcloud.com/ -adcsId 3
```

The Jamf AD CS Connector installs in outbound communication mode with the provided parameters and values.

If you want to change any configuration parameters, you must re-run the PowerShell installation script with all necessary configuration values. If you want to change the serviceDisplayName, you will need to uninstall the previous connector.