How to automatically issue a user one certificate for all machines where he logs in?

Question

Active Directory

There is a domain network, user certificates were needed, they raised their certification authority and set up automatic issuance of certificates in group policies. But there was a problem, if the user logs in under his account on another machine, then he receives a new certificate. It turns out on how many PCs the user logged in so many different certificates in his name and received, but I would like the user to receive a certificate when logging in and when logging in to other PCs, he would receive the same certificate there too. Is it real?

Answer 1

The CA does not store private keys, so the described scenario is not possible. If you need to use one certificate in many places, use a smart card or usb token to store it.