How to organize the work of employees on the EDS?

Question

System administration

Share your experience! Oh please !
How is work with a large number of
digital signatures organized? And that's just one portal.

It is very difficult to walk and add hands to the EDS registry.

I found a topic, but it discussed something completely different, but the following statement caught my eye:

" For more than a year, all our employees have been working only in published applications, and we centralize all this through Parallels RAS. We also have an automatic mechanism for publishing a digital signature: if an authorized user launches a site, let's say customs office, then the company's EDS is written in its HKCU and the necessary plug-in is launched "

Maybe one of you has already passed this stage?

Answer 1

I don’t rummage, but based on my limited knowledge, I imagine that it is possible to automatically deploy containers with keys to the user registry.
https://ca.kontur.ru/faq/teh/kopiya-klyuchevogo-ko...
at the end of the paragraph called: "Copying a container from another user's registry"
This is how to export one key from the registry to another user's registry. You need to pull one container from the registry, then write a powershell script that will request the sid of the current user (and the bitness of the system if you have a zoo), and substitute it for the sid of the previous user
and the resulting .reg file to run. And the script can be distributed through group policies. Through group policies, you can also distribute the certificate to the received container, there is no need to be so shamanistic there.
It should work in theoretical theory, at least for now I don't see why it shouldn't work.