Richard Hicks

Richard Hicks is the founder and principal consultant at Richard M. Hicks Consulting, Inc. With more than 25 years of experience implementing secure remote access and public key infrastructure (PKI) solutions, he is a widely recognized enterprise mobility and security infrastructure expert sought after by organizations worldwide. His mission is to help companies provide visibility, control, and assurance for their field-based devices, ensuring the highest level of security and productivity for today's highly mobile workforce.

[richardmhicks]

Mastering Certificates with Microsoft Intune September 2026 I’m excited to announce that I will be delivering another edition of the Mastering Certificates with Microsoft Intune course…...

View On WordPress

[richardmhicks]

Webinar: Certificate Automation in Practice – A Technical Deep Dive If you manage Windows Server workloads that require public TLS certificates like Always On VPN, DirectAccess, Remote Desktop Gateway, Internet Information Services (IIS), and others, you know that certificate expirations don’t send friendly reminders....

View On WordPress

[richardmhicks]

What’s New in Entra Global Secure Access Client v2.31.125 On June 2, 2026, Microsoft released version 2.31.125 of the Entra Global Secure Access (GSA) client. This update introduces several enhancements designed to improve client resiliency, simplify troubleshooting, and provide administrators with better visibility into network connection status....

View On WordPress

[richardmhicks]

REMINDER: Windows Server 2016 End of Life January 2027 – Plan Your AD CS Migration Now With just over six months remaining before Windows Server 2016 reaches end of support, now is the time to begin planning migrations for workloads hosted on this platform....

View On WordPress

[richardmhicks]

Troubleshooting NDES Error 0x80094800 Unsupported Cert Type on Windows Server 2025

With Windows Server 2016 fast approaching end of life (EOL – January 2027) I’ve been helping many customers get their existing Network Device Enrollment Service (NDES) server upgraded to Windows Server 2025. In the past I’ve had few problems deploying NDES on Windows Server 2016, 2019, and 2022. However, NDES deployments on Windows Server 2025 have proven more challenging. Unlike previous…

View On WordPress

[richardmhicks]

Troubleshooting NDES Error 0x80070003 Path Not Found on Windows Server 2025

When deploying enterprise PKI certificates with Microsoft Intune using SCEP, administrators must deploy one or more on-premises Network Device Enrollment Service (NDES) servers together with the Intune Certificate Connector. Installing and configuring NDES can be challenging because the solution includes multiple dependencies and has many moving parts. Troubleshooting installation failures can be…

View On WordPress

[richardmhicks]

Microsoft AD CS Adds Post-Quantum Cryptography Support with ML-DSA

Despite predictions of its decline, Microsoft Active Directory Certificate Services (AD CS) continues to evolve. Following significant enhancements introduced in late 2025, including CRL partitioning and support for 16K database pages, the May 2026 update adds another important capability: support for Post-Quantum Cryptography (PQC). ML-DSA Specifically, the May 2026 update adds support for…

View On WordPress

[richardmhicks]

Techmentor Event Microsoft HQ 2026

I’m pleased to announce I’ll be attending the Techmentor Event at Microsoft Headquarters in Redmond, WA, August 3-7, 2026. Register now and save $500.00 with the discount code HICKS. Sessions I’ll be delivering three sessions at this year’s event. TW22 – Moving to Zero Trust: Entra Private Access for Always On VPN Administrators TH02 – Certificates Groundhog Day: Mastering 47-Day Public TLS…

View On WordPress

[richardmhicks]

What's New in Always On VPN DPC v5.4.0

A new edition of the popular Always On VPN Dynamic Profile Configurator (DPC) is now available. Version 5.4.0, released on May 5, 2026, includes some new features, reliability improvements, and additional miscellaneous fixes. What’s New in DPC v5.4.0 The following new features and improvements are included in the latest release of DPC. Signed Binaries Beginning with release v5.4.0, all…

View On WordPress

[richardmhicks]

The Case for 6-Day Public TLS Certificates

In February 2025, Let’s Encrypt introduced the option to enroll for public TLS certificates with a 6-day validity period.  This represents a significant shift toward short-lived certificates and aligns with the broader industry trend of reducing certificate lifetimes to improve security. While this may seem aggressive at first glance, organizations that have embraced automation will find that…

View On WordPress

[richardmhicks]

What's New in Entra Global Secure Access Client v2.28.96

On April 27, 2026, Microsoft announced an update for the Entra Global Secure Access (GSA) client version 2.28.96. This new release includes improvements to the user experience for BYOD scenarios, to surface more information about endpoint status on the main screen, and to Intelligent Local Access (ILA). Sign Out Microsoft has changed how the Sign Out button is displayed depending on the…

View On WordPress

[richardmhicks]

Webinar: Certificate Automation for Windows Infrastructure

If you manage Windows Server workloads that require public TLS certificates like Always On VPN, DirectAccess, Remote Desktop Gateway, Internet Information Services (IIS), and others, you know that certificate expirations don’t send friendly reminders. Certificates expire quietly. Too often, end users are the ones who sound the alarm—when resources are already unavailable. Of course, this never…

View On WordPress

[richardmhicks]

Always On VPN with PEAP Fails in Windows 11 26H1

There appears to be a bug in the latest Windows 11 26H1 (no, that’s not a typo – 26H1) build affecting Protected Extensible Authentication Protocol (PEAP). In my testing, all VPN connection attempts (Always On VPN and manual/ad-hoc) failed when PEAP was used for authentication. Windows 11 26H1 Recently, while reviewing downloads and product keys in Visual Studio, I noticed a new Windows 11…

View On WordPress

[richardmhicks]

IIS TLS Certificate Deployment with CertKit

With public TLS certificate lifetimes shrinking to just 47 days by 2029, administrators must find ways to automate certificate enrollment and renewal for workloads that require them. One of the most common is Microsoft Internet Information Services (IIS). I’ve been using CertKit.io to handle this process for workloads like Always On VPN and DirectAccess, so it made sense to migrate my…

View On WordPress

[richardmhicks]

Always On VPN IKEv2 Security Vulnerability April 2026

Microsoft published its Security Updates for April 2026 today, and the good news is that there are no Windows Server Routing and Remote Access (RRAS) vulnerabilities this month. However, they disclosed a critical remote code execution (RCE) vulnerability that impacts deployments using Internet Key Exchange version 2 (IKEv2). IKE Service Extensions RCE CVE-2026-33824 addresses a security…

View On WordPress

[richardmhicks]

Entra Private Access and VPN Migration Strategies on Entra.News

I recently had the opportunity to connect with Merill Fernando from Microsoft as a guest on his popular Entra.News podcast to discuss Microsoft Entra Private Access, which is part of the Entra Global Secure Access Security Service Edge (SSE) service. We spent the hour talking about the similarities and differences between classic VPN technologies and zero-trust network access (ZTNA). In addition,…

View On WordPress

[richardmhicks]

DirectAccess IPHTTPS and Let's Encrypt 6-Day Certificates

I’ve written extensively about how public TLS certificate lifetimes will drop to just 47 days by March 2029. Before then, we’ll see certificate lifetimes gradually drop from the current 398 days to 200 days on March 15, 2026, and then to 100 days on March 15, 2027. In preparation for this, I’ve been working with many customers to deploy automated certificate enrollment and renewal solutions to…

View On WordPress