### Install ADCS Web Enrollment Feature and Configure

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsWebEnrollment

This configuration installs the ADCS Web Enrollment Windows Feature and then configures the AdcsWebEnrollment DSC resource. Ensure the ADCS-Web-Enrollment feature is installed before configuring the resource. The Credential parameter is mandatory and requires appropriate permissions.

```powershell
Configuration AdcsWebEnrollment_InstallWebEnrollment_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Web-Enrollment
        {
            Ensure = 'Present'
            Name   = 'ADCS-Web-Enrollment'
        }

        AdcsWebEnrollment WebEnrollment
        {
            Ensure           = 'Present'
            IsSingleInstance = 'Yes'
            Credential       = $Credential
            DependsOn        = '[WindowsFeature]ADCS-Web-Enrollment'
        }
    }
}
```

--------------------------------

### Install Gulp Globally

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/Running-Gulp-based-tests

Installs the Gulp command-line tool globally on your system. This is a prerequisite for running Gulp tasks.

```bash
npm install gulp --global
```

--------------------------------

### Install Project Dependencies

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/Running-Gulp-based-tests

Downloads and installs all the necessary Node.js modules for the current project, including Gulp plugins and other development dependencies.

```bash
npm install
```

--------------------------------

### Verify ActiveDirectoryCSDsc Installation

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/Home

Run this command after installation to confirm that the ActiveDirectoryCSDsc DSC resources are available on your system. This helps ensure the module was installed correctly.

```powershell
Get-DscResource -Module ActiveDirectoryCSDsc
```

--------------------------------

### Install ActiveDirectoryCSDsc Module and List Resources

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

Installs the ActiveDirectoryCSDsc module from the PowerShell Gallery and then lists all available DSC resources provided by the module. Ensure you have administrative privileges and internet access.

```powershell
# Install the module
Find-Module -Name ActiveDirectoryCSDsc -Repository PSGallery | Install-Module

# Confirm installed DSC resources
Get-DscResource -Module ActiveDirectoryCSDsc
```

--------------------------------

### Install and Configure ADCS Online Responder

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsOnlineResponder

This configuration installs the ADCS Online Responder feature and configures it as an OCSP server. It requires a valid credential for the service.

```powershell
Configuration AdcsOnlineResponder_InstallOnlineResponder_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Online-Cert
        {
            Ensure = 'Present'
            Name   = 'ADCS-Online-Cert'
        }

        AdcsOnlineResponder OnlineResponder
        {
            Ensure           = 'Present'
            IsSingleInstance = 'Yes'
            Credential       = $Credential
            DependsOn        = '[WindowsFeature]ADCS-Online-Cert'
        }
    }
}
```

--------------------------------

### Install ActiveDirectoryCSDsc Module

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/Home

Use this command to install the ActiveDirectoryCSDsc module from the PowerShell Gallery. Ensure you are using PowerShell 5.0 or later for PowerShellGet compatibility.

```powershell
Find-Module -Name ActiveDirectoryCSDsc -Repository PSGallery | Install-Module
```

--------------------------------

### Install ADCS Certificate Web Enrollment Service

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

Installs the ADCS Certificate Web Enrollment service. Requires appropriate credentials and ensures the 'ADCS-Web-Enrollment' Windows feature is present. Optionally configure connection to a remote CA using the 'CAConfig' parameter.

```powershell
Configuration AdcsWebEnrollment_InstallWebEnrollment_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Web-Enrollment
        {
            Ensure = 'Present'
            Name   = 'ADCS-Web-Enrollment'
        }

        AdcsWebEnrollment WebEnrollment
        {
            Ensure           = 'Present'
            IsSingleInstance = 'Yes'
            Credential       = $Credential
            # Omit CAConfig when a local CA is installed
            # CAConfig       = 'ca-server.contoso.com\Contoso Root CA'
            DependsOn        = '[WindowsFeature]ADCS-Web-Enrollment'
        }
    }
}
```

--------------------------------

### Full Two-Tier PKI Deployment with DSC

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

Automate a complete two-tier PKI deployment including CA installation, advanced settings, AIA/OCSP URIs, Web Enrollment, and an Online Responder. Requires Enterprise Admin credentials.

```powershell
Configuration ContosoTwoTierPKI
{
    param
    (
        [Parameter(Mandatory = $true)]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc
    Import-DscResource -Module PSDesiredStateConfiguration

    Node 'ca-server.contoso.com'
    {
        WindowsFeature ADCS-Cert-Authority    { Ensure = 'Present'; Name = 'ADCS-Cert-Authority' }
        WindowsFeature ADCS-Web-Enrollment    { Ensure = 'Present'; Name = 'ADCS-Web-Enrollment' }
        WindowsFeature ADCS-Online-Cert       { Ensure = 'Present'; Name = 'ADCS-Online-Cert' }

        AdcsCertificationAuthority CA
        {
            IsSingleInstance    = 'Yes'
            Ensure              = 'Present'
            Credential          = $Credential
            CAType              = 'EnterpriseRootCA'
            CACommonName        = 'Contoso Root CA'
            ValidityPeriod      = 'Years'
            ValidityPeriodUnits = 20
            DependsOn           = '[WindowsFeature]ADCS-Cert-Authority'
        }

        AdcsCertificationAuthoritySettings CASettings
        {
            IsSingleInstance    = 'Yes'
            CRLPeriodUnits      = 1
            CRLPeriod           = 'Months'
            CRLOverlapUnits     = 8
            CRLOverlapPeriod    = 'Hours'
            ValidityPeriodUnits = 10
            ValidityPeriod      = 'Years'
            DSConfigDN          = 'CN=Configuration,DC=CONTOSO,DC=COM'
            DSDomainDN          = 'DC=CONTOSO,DC=COM'
            AuditFilter         = @('StartAndStopADCS','IssueAndManageCertificateRequests','RevokeCertificatesAndPublishCRLs')
            DependsOn           = '[AdcsCertificationAuthority]CA'
        }

        AdcsAuthorityInformationAccess AIA
        {
            IsSingleInstance    = 'Yes'
            AiaUri              = @('http://pki.contoso.com/CertEnroll/<CATruncatedName>.cer')
            OcspUri             = @('http://ocsp.contoso.com/ocsp')
            AllowRestartService = $true
            DependsOn           = '[AdcsCertificationAuthority]CA'
        }

        AdcsWebEnrollment WebEnrollment
        {
            IsSingleInstance = 'Yes'
            Ensure           = 'Present'
            Credential       = $Credential
            DependsOn        = '[AdcsCertificationAuthority]CA', '[WindowsFeature]ADCS-Web-Enrollment'
        }

        AdcsOnlineResponder OCSP
        {
            IsSingleInstance = 'Yes'
            Ensure           = 'Present'
            Credential       = $Credential
            DependsOn        = '[AdcsCertificationAuthority]CA', '[WindowsFeature]ADCS-Online-Cert'
        }

        AdcsTemplate WebServerTemplate
        {
            Name      = 'WebServer'
            Ensure    = 'Present'
            DependsOn = '[AdcsCertificationAuthority]CA'
        }
    }
}

ContosoTwoTierPKI -Credential (Get-Credential -Message 'Enter Enterprise Admin credentials')
Start-DscConfiguration -Path .\ContosoTwoTierPKI -Wait -Verbose -Force
```

--------------------------------

### Install AdcsEnrollmentPolicyWebService with Certificate Authentication

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsEnrollmentPolicyWebService

Configures the Certificate Enrollment Policy Web Service to use Certificate authentication and operate in key-based renewal mode. Requires a specific SSL certificate thumbprint for IIS.

```powershell
Configuration AdcsEnrollmentPolicyWebService_InstallCertificateAuthentication_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Enroll-Web-Pol
        {
            Ensure = 'Present'
            Name   = 'ADCS-Enroll-Web-Pol'
        }

        AdcsEnrollmentPolicyWebService EnrollmentPolicyWebService
        {
            AuthenticationType = 'Certificate'
            SslCertThumbprint  = 'f0262dcf287f3e250d1760508c4ca87946006e1e'
            Credential         = $Credential
            KeyBasedRenewal    = $true
            Ensure             = 'Present'
            DependsOn          = '[WindowsFeature]ADCS-Enroll-Web-Pol'
        }
    }
}
```

--------------------------------

### Install AD CS Enterprise Root CA

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsCertificationAuthority

Installs the AD CS Certificate Authority feature and configures it as an enterprise root CA. Ensure the ActiveDirectoryCSDsc module is imported.

```powershell
Configuration AdcsCertificationAuthority_InstallCertificationAthority_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Cert-Authority
        {
            Ensure = 'Present'
            Name   = 'ADCS-Cert-Authority'
        }

        AdcsCertificationAuthority CertificateAuthority
        {
            IsSingleInstance = 'Yes'
            Ensure           = 'Present'
            Credential       = $Credential
            CAType           = 'EnterpriseRootCA'
            DependsOn        = '[WindowsFeature]ADCS-Cert-Authority'
        }
    }
}
```

--------------------------------

### Install AdcsEnrollmentPolicyWebService with Kerberos Authentication

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsEnrollmentPolicyWebService

Configures the Certificate Enrollment Policy Web Service to use Kerberos authentication. Key-based renewal is not supported with Kerberos. Requires a specific SSL certificate thumbprint for IIS.

```powershell
Configuration AdcsEnrollmentPolicyWebService_InstallKerberosAuthentication_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Enroll-Web-Pol
        {
            Ensure = 'Present'
            Name   = 'ADCS-Enroll-Web-Pol'
        }

        AdcsEnrollmentPolicyWebService EnrollmentPolicyWebService
        {
            AuthenticationType = 'Kerberos'
            SslCertThumbprint  = 'f0262dcf287f3e250d1760508c4ca87946006e1e'
            Credential         = $Credential
            KeyBasedRenewal    = $false
            Ensure             = 'Present'
            DependsOn          = '[WindowsFeature]ADCS-Enroll-Web-Pol'
        }
    }
}
```

--------------------------------

### Configure and Install Enterprise Root CA

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

This configuration installs the AD CS Certification Authority role as an Enterprise Root CA. It requires the 'ADCS-Cert-Authority' Windows feature to be present and necessitates domain administrator credentials for enterprise CAs. Ensure the specified directories exist or are creatable.

```powershell
Configuration AdcsCertificationAuthority_InstallEnterpriseRootCA_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        # Step 1: Ensure the Windows feature is present
        WindowsFeature ADCS-Cert-Authority
        {
            Ensure = 'Present'
            Name   = 'ADCS-Cert-Authority'
        }

        # Step 2: Install and configure the CA
        AdcsCertificationAuthority CertificateAuthority
        {
            IsSingleInstance          = 'Yes'
            Ensure                    = 'Present'
            Credential                = $Credential
            CAType                    = 'EnterpriseRootCA'
            CACommonName              = 'Contoso Root CA'
            CADistinguishedNameSuffix = 'DC=CONTOSO,DC=COM'
            HashAlgorithmName         = 'SHA256'
            KeyLength                 = 4096
            ValidityPeriod            = 'Years'
            ValidityPeriodUnits       = 20
            DatabaseDirectory         = 'C:\\Windows\\system32\\CertLog'
            LogDirectory              = 'C:\\Windows\\system32\\CertLog'
            DependsOn                 = '[WindowsFeature]ADCS-Cert-Authority'
        }
    }
}

# Compile and apply
AdcsCertificationAuthority_InstallEnterpriseRootCA_Config -Credential (Get-Credential)
Start-DscConfiguration -Path .\AdcsCertificationAuthority_InstallEnterpriseRootCA_Config -Wait -Verbose -Force
```

--------------------------------

### Install ADCS Certificate Enrollment Policy Web Service

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

Installs the ADCS Certificate Enrollment Policy Web Service. Supports different authentication types (Certificate, Kerberos, UserName) and key-based renewal. The 'AuthenticationType' parameter is crucial for identifying service instances.

```powershell
Configuration AdcsEnrollmentPolicyWebService_CertAuth_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Enroll-Web-Pol
        {
            Ensure = 'Present'
            Name   = 'ADCS-Enroll-Web-Pol'
        }

        # Instance 1: Certificate-based authentication with key-based renewal
        AdcsEnrollmentPolicyWebService CertificateAuth
        {
            AuthenticationType = 'Certificate'
            SslCertThumbprint  = 'f0262dcf287f3e250d1760508c4ca87946006e1e'
            Credential         = $Credential
            KeyBasedRenewal    = $true
            Ensure             = 'Present'
            DependsOn          = '[WindowsFeature]ADCS-Enroll-Web-Pol'
        }

        # Instance 2: Kerberos-based authentication (key-based renewal not supported)
        AdcsEnrollmentPolicyWebService KerberosAuth
        {
            AuthenticationType = 'Kerberos'
            SslCertThumbprint  = 'f0262dcf287f3e250d1760508c4ca87946006e1e'
            Credential         = $Credential
            KeyBasedRenewal    = $false
            Ensure             = 'Present'
            DependsOn          = '[WindowsFeature]ADCS-Enroll-Web-Pol'
        }
    }
}
```

--------------------------------

### Configure AD CS Certification Authority Settings

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

Use this snippet to configure advanced settings on an existing AD CS Certification Authority. It requires the CA to be already installed and configured. Ensure the `ActiveDirectoryCSDsc` module is imported.

```powershell
Configuration AdcsCertificationAuthoritySettings_EnterpriseCA_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Cert-Authority
        {
            Ensure = 'Present'
            Name   = 'ADCS-Cert-Authority'
        }

        AdcsCertificationAuthority CertificateAuthority
        {
            IsSingleInstance = 'Yes'
            Ensure           = 'Present'
            Credential       = $Credential
            CAType           = 'EnterpriseRootCA'
            DependsOn        = '[WindowsFeature]ADCS-Cert-Authority'
        }

        AdcsCertificationAuthoritySettings CertificateAuthoritySettings
        {
            IsSingleInstance      = 'Yes'
            # CA cert publication URLs (type prefix: 1=local, 2=LDAP, 2=HTTP)
            CACertPublicationURLs = @(
                '1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt'
                '2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11'
                '2:http://pki.contoso.com/CertEnroll/%1_%3%4.crt'
            )
            # CRL publication URLs (type prefix: 65=local, 79=LDAP, 6=HTTP)
            CRLPublicationURLs    = @(
                '65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl'
                '79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10'
                '6:http://pki.contoso.com/CertEnroll/%3%8%9.crl'
            )
            CRLOverlapUnits       = 8
            CRLOverlapPeriod      = 'Hours'
            CRLPeriodUnits        = 1
            CRLPeriod             = 'Months'
            ValidityPeriodUnits   = 10
            ValidityPeriod        = 'Years'
            DSConfigDN            = 'CN=Configuration,DC=CONTOSO,DC=COM'
            DSDomainDN            = 'DC=CONTOSO,DC=COM'
            AuditFilter           = @(
                'StartAndStopADCS'
                'BackupAndRestoreCADatabase'
                'IssueAndManageCertificateRequests'
                'RevokeCertificatesAndPublishCRLs'
                'ChangeCASecuritySettings'
                'StoreAndRetrieveArchivedKeys'
                'ChangeCAConfiguration'
            )
            DependsOn             = '[AdcsCertificationAuthority]CertificateAuthority'
        }
    }
}

```

--------------------------------

### AdcsCertificationAuthority Resource

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

This snippet demonstrates how to install and configure an Enterprise Root Certification Authority using the `AdcsCertificationAuthority` DSC resource. It ensures the necessary Windows feature is present before configuring the CA with specified parameters like common name, distinguished name suffix, key length, and validity period.

```APIDOC
## AdcsCertificationAuthority

Installs or uninstalls an AD CS Certification Authority role after the `ADCS-Cert-Authority` Windows feature has been added. Supports all four CA types: `EnterpriseRootCA`, `EnterpriseSubordinateCA`, `StandaloneRootCA`, and `StandaloneSubordinateCA`. Enterprise CA installation requires Domain Admin or Enterprise Admin credentials.

### Resource
`AdcsCertificationAuthority`

### Parameters
- **IsSingleInstance** (string) - Required - Specifies if the resource should be a single instance.
- **Ensure** (string) - Required - 'Present' to install, 'Absent' to uninstall.
- **Credential** (PSCredential) - Required - Credentials for domain-joined CA installation.
- **CAType** (string) - Required - Type of CA to install (e.g., 'EnterpriseRootCA').
- **CACommonName** (string) - Required - The common name for the CA.
- **CADistinguishedNameSuffix** (string) - Required - The distinguished name suffix for the CA.
- **HashAlgorithmName** (string) - Optional - The hashing algorithm to use (e.g., 'SHA256').
- **KeyLength** (int) - Optional - The key length for the CA's key pair.
- **ValidityPeriod** (string) - Optional - The validity period unit (e.g., 'Years').
- **ValidityPeriodUnits** (int) - Optional - The number of units for the validity period.
- **DatabaseDirectory** (string) - Optional - The directory for the CA database.
- **LogDirectory** (string) - Optional - The directory for the CA logs.
- **DependsOn** (string) - Optional - Specifies dependencies on other resources.

### Example
```powershell
Configuration AdcsCertificationAuthority_InstallEnterpriseRootCA_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        # Step 1: Ensure the Windows feature is present
        WindowsFeature ADCS-Cert-Authority
        {
            Ensure = 'Present'
            Name   = 'ADCS-Cert-Authority'
        }

        # Step 2: Install and configure the CA
        AdcsCertificationAuthority CertificateAuthority
        {
            IsSingleInstance          = 'Yes'
            Ensure                    = 'Present'
            Credential                = $Credential
            CAType                    = 'EnterpriseRootCA'
            CACommonName              = 'Contoso Root CA'
            CADistinguishedNameSuffix = 'DC=CONTOSO,DC=COM'
            HashAlgorithmName         = 'SHA256'
            KeyLength                 = 4096
            ValidityPeriod            = 'Years'
            ValidityPeriodUnits       = 20
            DatabaseDirectory         = 'C:\Windows\system32\CertLog'
            LogDirectory              = 'C:\Windows\system32\CertLog'
            DependsOn                 = '[WindowsFeature]ADCS-Cert-Authority'
        }
    }
}

# Compile and apply
AdcsCertificationAuthority_InstallEnterpriseRootCA_Config -Credential (Get-Credential)
Start-DscConfiguration -Path .\AdcsCertificationAuthority_InstallEnterpriseRootCA_Config -Wait -Verbose -Force
```
```

--------------------------------

### Remove DomainController CA Template

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsTemplate

This example demonstrates how to remove a CA template, like 'DomainController', from the server. The 'Ensure' parameter should be set to 'Absent'.

```powershell
Configuration AdcsTemplate_RemoveTemplate_Config
{
    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        AdcsTemplate DomainController
        {
            Name   = 'DomainController'
            Ensure = 'Absent'
        }
    }
}
```

--------------------------------

### Configure AIA and OCSP URIs

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsAuthorityInformationAccess

Configures both Authority Information Access and Online Responder OCSP URIs simultaneously. Requires `IsSingleInstance` to be 'Yes'.

```powershell
configuration AdcsAuthorityInformationAccess_SetAiaAndOcsp_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsAuthorityInformationAccess SetAiaAndOcsp
        {
            IsSingleInstance    = 'Yes'
            AiaUri              = @(
                'http://setAIATest1/Certs/<CATruncatedName>.cer'
                'http://setAIATest2/Certs/<CATruncatedName>.cer'
                'http://setAIATest3/Certs/<CATruncatedName>.cer'
                'file://<ServerDNSName>/CertEnroll/<ServerDNSName>_<CAName><CertificateName>.crt'
            )
            OcspUri             = @(
                'http://primary-ocsp-responder/ocsp'
                'http://secondary-ocsp-responder/ocsp'
                'http://tertiary-ocsp-responder/ocsp'
            )
            AllowRestartService = $true
        }
    }
}
```

--------------------------------

### Configure OCSP URIs

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsAuthorityInformationAccess

Sets the Online Responder OCSP URIs for the OCSP extension. The `IsSingleInstance` parameter must be 'Yes'.

```powershell
configuration AdcsAuthorityInformationAccess_SetOcsp_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsAuthorityInformationAccess SetOcsp
        {
            IsSingleInstance    = 'Yes'
            OcspUri             = @(
                'http://primary-ocsp-responder/ocsp'
                'http://secondary-ocsp-responder/ocsp'
                'http://tertiary-ocsp-responder/ocsp'
            )
            AllowRestartService = $true
        }
    }
}
```

--------------------------------

### Run Integration Tests in ActiveDirectoryCSDsc

Source: https://github.com/dsccommunity/activedirectorycsdsc/blob/main/CHANGELOG.md

Use this command to manually run integration tests when the build task 'test' is executed. It specifies the Pester script path and sets the code coverage threshold to 0.

```powershell
.\build.ps1 -Tasks test -PesterScript 'tests/Integration' -CodeCoverageThreshold 0
```

--------------------------------

### Configure Authority Information Access (AIA) and OCSP URIs

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

Use this snippet to configure the URIs published in the Authority Information Access (AIA) and Online Certificate Status Protocol (OCSP) extensions of certificates issued by the CA. The `AllowRestartService` parameter can be set to `$true` to restart the CA service if changes are made.

```powershell
configuration AdcsAuthorityInformationAccess_SetAiaAndOcsp_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsAuthorityInformationAccess SetAiaAndOcsp
        {
            IsSingleInstance    = 'Yes'
            # AIA URIs embedded in issued certificates
            AiaUri              = @(
                'http://pki.contoso.com/CertEnroll/<CATruncatedName>.cer'
                'file://<ServerDNSName>/CertEnroll/<ServerDNSName>_<CAName><CertificateName>.crt'
            )
            # OCSP responder URIs for certificate status checking
            OcspUri             = @(
                'http://ocsp-primary.contoso.com/ocsp'
                'http://ocsp-secondary.contoso.com/ocsp'
            )
            # Restart the CA service if URIs are changed
            AllowRestartService = $true
        }
    }
}

```

```powershell
# To clear all AIA and OCSP URIs:
configuration AdcsAuthorityInformationAccess_ClearAll_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsAuthorityInformationAccess ClearAll
        {
            IsSingleInstance    = 'Yes'
            AiaUri              = @()
            OcspUri             = @()
            AllowRestartService = $true
        }
    }
}

```

--------------------------------

### Configure AIA URIs

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsAuthorityInformationAccess

Sets the Authority Information Access URIs for the AIA extension. Ensure the `IsSingleInstance` parameter is set to 'Yes'.

```powershell
configuration AdcsAuthorityInformationAccess_SetAia_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsAuthorityInformationAccess SetAia
        {
            IsSingleInstance    = 'Yes'
            AiaUri              = @(
                'http://setAIATest1/Certs/<CATruncatedName>.cer'
                'http://setAIATest2/Certs/<CATruncatedName>.cer'
                'http://setAIATest3/Certs/<CATruncatedName>.cer'
                'file://<ServerDNSName>/CertEnroll/<ServerDNSName>_<CAName><CertificateName>.crt'
            )
            AllowRestartService = $true
        }
    }
}
```

--------------------------------

### Add OCSP URI Path Extensions

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsOcspExtension

Use this configuration to add OCSP URI paths to a Certificate Authority. This will overwrite any existing OCSP URI paths.

```powershell
configuration AdcsOcspExtension_AddOcspPath_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsOcspExtension AddOcspUriPath
        {
            IsSingleInstance = 'Yes'
            OcspUriPath      = @(
                'http://primary-ocsp-responder/ocsp'
                'http://secondary-ocsp-responder/ocsp'
                'http://tertiary-ocsp-responder/ocsp'
            )
            RestartService   = $true
            Ensure           = 'Present'
        }
    }
}
```

--------------------------------

### Configure Enterprise Root CA with ADCS

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsCertificationAuthoritySettings

Use this snippet to add the AD CS Certificate Authority feature and configure it as an enterprise root CA. It also sets certificate publication and CRL URLs, overlap periods, validity periods, and audit filter settings.

```powershell
Configuration AdcsCertificationAuthoritySettings_EnterpriseCA_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        WindowsFeature ADCS-Cert-Authority
        {
            Ensure = 'Present'
            Name   = 'ADCS-Cert-Authority'
        }

        AdcsCertificationAuthority CertificateAuthority
        {
            IsSingleInstance = 'Yes'
            Ensure           = 'Present'
            Credential       = $Credential
            CAType           = 'EnterpriseRootCA'
            DependsOn        = '[WindowsFeature]ADCS-Cert-Authority'
        }

        AdcsCertificationAuthoritySettings CertificateAuthoritySettings
        {
            IsSingleInstance = 'Yes'
            CACertPublicationURLs = @(
                '1:C:\Windows\system32\CertSrv\CertEnroll\%1_%3%4.crt'
                '2:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11'
                '2:http://pki.contoso.com/CertEnroll/%1_%3%4.crt'
            )
            CRLPublicationURLs =  @(
                '65:C:\Windows\system32\CertSrv\CertEnroll\%3%8%9.crl'
                '79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10'
                '6:http://pki.contoso.com/CertEnroll/%3%8%9.crl'
            )
            CRLOverlapUnits = 8
            CRLOverlapPeriod = 'Hours'
            CRLPeriodUnits = 1
            CRLPeriod = 'Months'
            ValidityPeriodUnits = 10
            ValidityPeriod = 'Years'
            DSConfigDN = 'CN=Configuration,DC=CONTOSO,DC=COM'
            DSDomainDN = 'DC=CONTOSO,DC=COM'
            AuditFilter = @(
                'StartAndStopADCS'
                'BackupAndRestoreCADatabase'
                'IssueAndManageCertificateRequests'
                'RevokeCertificatesAndPublishCRLs'
                'ChangeCASecuritySettings'
                'StoreAndRetrieveArchivedKeys'
                'ChangeCAConfiguration'
            )
            DependsOn        = '[AdcsCertificationAuthority]CertificateAuthority'
        }
    }
}

```

--------------------------------

### Add KerberosAuthentication CA Template

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsTemplate

Use this snippet to add a specific CA template, such as 'KerberosAuthentication', to the server. Ensure the ActiveDirectoryCSDsc module is imported.

```powershell
Configuration AdcsTemplate_AddTemplate_Config
{
    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        AdcsTemplate KerberosAuthentication
        {
            Name   = 'KerberosAuthentication'
            Ensure = 'Present'
        }
    }
}
```

--------------------------------

### Manage Certificate Templates with AdcsTemplate

Source: https://context7.com/dsccommunity/activedirectorycsdsc/llms.txt

Use the AdcsTemplate resource to add or remove certificate templates from an Enterprise CA. Ensure template names match those published in Active Directory.

```powershell
Configuration AdcsTemplate_ManageTemplates_Config
{
    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        # Add the KerberosAuthentication template
        AdcsTemplate KerberosAuthentication
        {
            Name   = 'KerberosAuthentication'
            Ensure = 'Present'
        }

        # Add the WebServer template
        AdcsTemplate WebServer
        {
            Name   = 'WebServer'
            Ensure = 'Present'
        }

        # Remove the legacy DomainController template
        AdcsTemplate DomainController
        {
            Name   = 'DomainController'
            Ensure = 'Absent'
        }
    }
}
```

--------------------------------

### Remove OCSP URI Path Extensions

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsOcspExtension

Use this configuration to remove OCSP URI paths from a Certificate Authority. This action does not affect other previously configured OCSP URI paths.

```powershell
configuration AdcsOcspExtension_RemoveOcspPath_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsOcspExtension RemoveOcspUriPath
        {
            IsSingleInstance = 'Yes'
            OcspUriPath      = @(
                'http://primary-ocsp-responder/ocsp'
                'http://secondary-ocsp-responder/ocsp'
                'http://tertiary-ocsp-responder/ocsp'
            )
            RestartService   = $true
            Ensure           = 'Absent'
        }
    }
}
```

--------------------------------

### Clear AIA and OCSP URIs

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsAuthorityInformationAccess

Clears the Authority Information Access and Online Responder OCSP URIs by setting them to empty arrays. Ensure `IsSingleInstance` is 'Yes'.

```powershell
configuration AdcsAuthorityInformationAccess_ClearAiaAndOcsp_Config
{
    Import-DscResource -ModuleName ActiveDirectoryCSDsc

    node localhost
    {
        AdcsAuthorityInformationAccess ClearAiaAndOcsp
        {
            IsSingleInstance    = 'Yes'
            AiaUri              = @()
            OcspUri             = @()
            AllowRestartService = $true
        }
    }
}
```

--------------------------------

### Retire AD CS Certificate Authority

Source: https://github.com/dsccommunity/activedirectorycsdsc/wiki/AdcsCertificationAuthority

Retires an AD CS certificate authority and uninstalls the feature. This configuration overwrites existing CA root certificates in Active Directory if they exist. Ensure the ActiveDirectoryCSDsc module is imported.

```powershell
Configuration AdcsCertificationAuthority_RetireCertificationAthority_Config
{
    param
    (
        [Parameter(Mandatory = $true)]
        [ValidateNotNullorEmpty()]
        [System.Management.Automation.PSCredential]
        $Credential
    )

    Import-DscResource -Module ActiveDirectoryCSDsc

    Node localhost
    {
        AdcsCertificationAuthority CertificateAuthority
        {
            IsSingleInstance          = 'Yes'
            Ensure                    = 'Absent'
            Credential                = $Credential
            CAType                    = 'EnterpriseRootCA'
            CACommonName              = 'Contoso Root CA'
            CADistinguishedNameSuffix = 'DC=CONTOSO,DC=COM'
            OverwriteExistingCAinDS   = $True
        }

        WindowsFeature ADCS-Cert-Authority
        {
            Ensure    = 'Absent'
            Name      = 'ADCS-Cert-Authority'
            DependsOn = '[AdcsCertificationAuthority]CertificateAuthority'
        }
    }
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.