Setting Unique OIDs to the default Levels of Assurance

from understand when install enterprise ca, oids default levels of assurance (low, medium , high) automatically set oids may partially include forest guid. if want assign these oids registered , uniquely assign oids each of levels of assurance, have specify them in "capolicy.inf" file. if so, there specific section under have specify these. please suggest.

1. not use default oids, microsoft owned oids. (1.3.1.6.4.1.311 microsoft arc).

2. oid arc iana (they free)

3. need add following sections @ top of capolicy.inf file.
    if running windows server 2008 r2,
    - 2 tiered: apply @ each issuing ca
    - 3 tiered or more: apply @ policy ca , subordinate issuing cas.
    can define subset @ each issuing ca, cannot introduce new oids.

4. deploy capolicy.inf shown below:

[version]
signature="$windows nt$"

[policystatementextension]
policies=basic,medium,high
critical=false

[basic]
oid=1.3.6.1.4.1.#####.509.1.1.2
[medium]
oid=1.3.6.1.4.1.#####.509.1.1.3
[high]
oid=1.3.6.1.4.1.#####.509.1.1.4

replace ##### arc number assigned iana

brian

 

Windows Server  >  Security