You can use Windows Registry settings on the enrollment server OS to configure which domains to connect to, various timeout periods, polling periods, and retries, and whether to prefer using the certificate authority that is installed on the same local server (recommended).

To change the advanced configuration settings, you can open the Windows Registry Editor (regedit.exe) on the enrollment server machine and navigate to the following registry key:

HKLM\SOFTWARE\VMware, Inc.\VMware VDM\Enrollment Service
Table 1. Registry Keys for Configuring True SSO on the Enrollment Server

Registry Key

Min & Max

Type

Description

ConnectToDomains

N/A

REG_MULTI_SZ

List of domains the enrollment server attempts to connect to automatically. For this multi-string registry type, the DNS fully qualified domain name (FQDN) of each domain is listed on its own line.

The default is to trust all domains.

ExcludeDomains

N/A

REG_MULTI_SZ

List of domains the enrollment server does not connect to automatically. If the connection server provides a configuration set with any of the domains, the enrollment server will attempt to connect to that domain or domains. For this multi-string registry type, the DNS FQDN of each domain is listed on its own line.

The default is to exclude no domains.

ConnectToDomainsInForest

N/A

REG_SZ

Specifies whether to connect to and use all domains in the forest that the enrollment server is a member of. The default is TRUE.

Use one of the following values:

  • 0 means false; do not connect to the domains of the forest being used.

  • !=0 means true.

ConnectToTrustingDomains

N/A

REG_SZ

Specifies whether to connect to explicitly trusting/incoming domains. The default is TRUE.

Use one of the following values:

  • 0 means false; do not connect to explicitly trusting/incoming domains.

  • !=0 means true.

PreferLocalCa

N/A

REG_SZ

Specifies whether to prefer the locally installed CA, if available, for performance benefits. If set to TRUE, the enrollment server will send requests to the local CA. If the connection to the local CA fails, the enrollment server will try to send certificates requests to alternate CAs. The default is FALSE.

Use one of the following values:

  • 0 means false.

  • !=0 means true.

MaxSubmitRetryTime

9500- 59000

DWORD

Amount of time to wait before retrying to submit a certificate signing request, in milliseconds. The default is 25000.

SubmitLatencyWarningTime

500 - 5000

DWORD

Submit latency warning time when the interface is marked "Degraded" (in milliseconds). The default is 1500.

The enrollment server uses this setting to determine whether a CA should be considered to be in a degraded state. If the last three certificate requests took more milliseconds to complete than are specified by this setting, the CA is considered degraded, and this status appears in the View Administrator Health Status dashboard.

A CA usually issues a certificate within 20 ms, but if the CA has been idle for a few hours, any initial request might take longer to complete. This setting allows an administrator to find out that a CA is slow, without necessary having the CA marked as slow. Use this setting to configure the threshold for marking the CA as slow.