New Active Directory Documents for IT Pros
Be sure that you've planned your PKI. Then, see Offline Root CA.