As per Brian Komar's AD CS books I have used inf files when installing the AD CS role and then batch files for applying settings like CDP extensions. Below is an example inf I use in labs for a root CA and a batch file to run after the role has been installed:
[Version] Signature="$Windows NT$" [certsrv_server] renewalkeylength=2048 RenewalValidityPeriodUnits=20 RenewalValidityPeriod=years CRLPeriod=weeks CRLPeriodUnits=26 CRLOverlapPeriod=weeks CRLOverlapUnits=2 CRLDeltaPeriodUnits=0 CRLDeltaPeriod=days DiscreteSignatureAlgorithm=1
::::::::::Declare Configuration NC certutil -setreg CA\DSConfigDN CN=Configuration,DC=lab,DC=local ::::::::::Define CRL Publication Intervals certutil -setreg CA\CRLPeriodUnits 26 certutil -setreg CA\CRLPeriod "Weeks" certutil -setreg CA\CRLDeltaPeriodUnits 0 certutil -setreg CA\CRLDeltaPeriod "Days" certutil -setreg CA\CRLOverlapPeriod "Weeks" certutil -setreg CA\CRLOverlapUnits 2 ::::::::::Apply the required CDP Extension URLs certutil -setreg CA\CRLPublicationURLs "1:%windir%\system32\CertSrv\CertEnroll\%%3%%8%%9.crl\n10:ldap:///CN=%%7%%8,CN=%%2,CN=CDP,CN=Public Key Services,CN=Services,%%6%%10\n2:http://corp.labnet.local/Certdata/%%3%%8%%9.crl" ::::::::::Apply the required AIA Extension URLs certutil -setreg CA\CACertPublicationURLs "1:%windir%\system32\CertSrv\CertEnroll\%%1_%%3%%4.crt\n2:ldap:///CN=%%7,CN=AIA,CN=Public Key Services,CN=Services,%%6%%11\n2:http://corp.labnet.local/CertData/%%1_%%3%%4.crt" ::::::::::Enable all auditing events for the lab Corporate Root CA certutil -setreg CA\AuditFilter 127 ::::::::::Set Validity Period for Issued Certificates certutil -setreg CA\ValidityPeriodUnits 10 certutil -setreg CA\ValidityPeriod "Years" ::::::::::Enable discrete signatures in subordinate CA certificates Certutil -setreg CA\csp\DiscreteSignatureAlgorithm 1 ::::::::::Restart Certificate Services net stop certsvc & net start certsvc timeout /t 10 /nobreak certutil -crl ::::::::::Copy the Root CA certificates and CRLs to the USB Drive Echo Insert the USB Drive in the USB slot and assign letter f: mkdir F:\CertCopy\ pause timeout /t 10 /nobreak copy /y %windir%\system32\certsrv\certenroll\*.cr? F:\CertCopy\ pause
Now looking at the new Install-ADcsCertificationAuthority cmdlet it looks like it can apply most of these settings, but does not include parameters to set CRLDeltas.
Is using inf files and batch files like this still the preferred way or has it been superseded by other cmdlets that can apply ALL of these settings during an installation of the role?