Übersicht über die für die PKI relevanten Active Directory Ereignisse

Nachfolgend eine Übersicht über die für die Public Key Infrastruktur relevanten auf Domänencontrollern erzeugten Ereignisse in der Windows-Ereignisanzeige.

Ereignisquellen

Die Ereignisse der Domönencontroller werden in das System-Protokoll geschrieben. Folgende Quellen enthalten PKI-relevante Active Directory-Ereignisse:

  • Microsoft-Windows-Kerberos-Key-Distribution-Center

Ereignisquelle Microsoft-Windows-Kerberos-Key-Distribution-Center

IDTypEreignistext
19WarnungThis event indicates an attempt was made to use smartcard logon, but the KDC is unable to use the PKINIT protocol because it is missing a suitable certificate.
20WarnungThe currently selected KDC certificate was once valid, but now is invalid and no suitable replacement was found. Smartcard logon may not function correctly if this problem is not remedied. Have the system administrator check on the state of the domain’s public key infrastructure. The chain status is in the error data.
21WarnungThe client certificate for the user %1\%2 is not valid, and resulted in a failed smartcard logon. Please contact the user for more information about the certificate they’re attempting to use for smartcard logon. The chain status was : %3
29WarnungThe Key Distribution Center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate.
32WarnungThe Key Distribution Center (KDC) uses a certificate without KDC Extended Key Usage (EKU) which can result in authentication failures for device certificate logon and smart card logon from non-domain-joined devices. Enrollment of a KDC certificate with KDC EKU (Kerberos Authentication template) is required to remove this warning.
120FehlerThe Key Distribution Center (KDC) failed to validate its current KDC certificate. This KDC might not be enabled for smart card or certificate authentication. Kdc Certificate Information: Issuer Name: %1 Serial Number: %2 Thumbprint: %3 Template: %4 Kerberos Error: %5 Validation Error: %6
200WarnungThe Key Distribution Center (KDC) cannot find a suitable certificate to use. This KDC is not enabled for smart card or certificate authentication.
302InformationThe Key Distribution Center (KDC) uses the below KDC certificate for smart card or certificate authentication. Kdc Certificate Information: Issuer Name: %1 Serial Number: %2 Thumbprint: %3 Template: %4

Weiterführende Links:

Ein Gedanke zu „Übersicht über die für die PKI relevanten Active Directory Ereignisse“

Kommentare sind geschlossen.