Category: Certificate Enrollment Web Services

Limits of Microsoft Active Directory Certificate Services

Active Directory Certificate Services have existed (albeit under a different name) in their basic form since Windows NT 4.0. The Active Directory-based architecture used today was introduced with Windows 2000 Server. AD CS is very well integrated into the Windows ecosystem and continues to enjoy great popularity worldwide in companies and government agencies of all sizes.

People like to point out the many possibilities offered by Active Directory Certificate Services. Rarely, however, is it pointed out what is not possible with them. In fact, the product has by now reached its limits in many places.

What these are will be explained in more detail below in order to better decide whether AD CS can be the right solution for planned projects.

Continue reading "Limits of Microsoft Active Directory Certificate Services"

Details of the event with ID 80 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll

Event Source:Microsoft-Windows-CertificateServicesClient-CertEnroll
Event ID:80 (0x825A0050)
Event log:Application
Event type:Warning
Event text (English):Certificate enrollment for %1 cannot enroll for a %2 certificate because the certificate enrollment server %3 is ROBO and only renewal is supported
Event text (German):Die Zertifikatregistrierung für %1 kann sich nicht für ein Zertifikat %2 registrieren, da es sich bei dem Zertifikatregistrierungsserver %3 um einen ROBO-Server handelt und nur die Erneuerung unterstützt wird.

Continue reading "Details of the event with ID 80 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

The role configuration for the Certificate Enrollment Web Service (CES) fails with error message "Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)"

Assume the following scenario:

  • A role configuration for the Certificate Enrollment Web Service (CES) is performed.
  • The role configuration fails with the following error message:
CCertificateEnrollmenServerSetup::InitializeInstallDefaults: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

Continue reading "The role configuration for the Certificate Enrollment Web Service (CES) fails with error message "Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)""

The role configuration for the Certificate Enrollment Web Service (CES) fails with error message "The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)"

Assume the following scenario:

  • A role configuration for the Certificate Enrollment Web Service (CES) is performed.
  • The role configuration fails with the following error message:
The Certificate Enrollment Web Service Setup failed because the CA "CA02.intra.adcslabor.de\ADCS Labor Issuing CA 1" cannot  be contacted. Check the name, and confirm that the CA is properly configured and available. The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)

Continue reading "The role configuration for the Certificate Enrollment Web Service (CES) fails with error message "The RPC server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE)""

Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests."

Assume the following scenario:

  • A Windows role related to Active Directory Certificate Services (Certification Authority, Network Device Enrollment Service (NDES), Certification Authority Web Enrollment (CAWE), Certificate Enrollment Web Services (CEP, CES), or Online Responder (OCSP)) is to be installed or uninstalled.
  • The installation or uninstallation fails with the following error message:
The status of the role services on the target machine cannot be determined. Please retry. The error is The WS-Management service cannot process the request. The service is configured to not accept any remote shell requests.

Continue reading "Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests.""

Details of the event with ID 21 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:21 (0x15)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Information
Event text (English):A service end point with URI %1 has been configured for this service. The client authentication scheme is %2. Only policies that contain certificate templates that are enabled for key based renewal will be returned to the client. Client certificates without subject information in the Active Directory database can be used to retrieve certificate templates. Use the Group Policy Management Console or the Certificates snap-in to configure clients with this Certificate Enrollment Policy Web Service information.
Event text (German):Für diesen Dienst wurde ein Dienstendpunkt mit URI "%1" konfiguriert. Das Clientauthentifizierungsschema lautet "%2". Nur Richtlinien mit Zertifikatvorlagen, die für die schlüsselbasiere Erneuerung konfiguriert sind, werden an den Client zurückgegeben. Zertifikatvorlagen können mit Clientzertifikaten ohne Antragstellerinformationen in der Active Directory-Datenbank abgerufen werden. Verwenden Sie die Gruppenrichtlinien-Verwaltungskonsole oder das Snap-In "Zertifikate", um Clients mit Informationen dieses Zertifikatregistrierungsrichtlinien-Webdiensts zu konfigurieren.

Continue reading "Details of the event with ID 21 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 20 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:20 (0x14)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Information
Event text (English):A service end point with URI %1 has been configured for this service. The client authentication scheme is %2. Only policies that contain certificate templates that are enabled for key based renewal will be returned to the client. Use the Group Policy Management Console or the Certificates snap-in to configure clients with this Certificate Enrollment Policy Web Service information.
Event text (German):Für diesen Dienst wurde ein Dienstendpunkt mit URI "%1" konfiguriert. Das Clientauthentifizierungsschema lautet "%2". Nur Richtlinien mit Zertifikatvorlagen, die für die schlüsselbasiere Erneuerung konfiguriert sind, werden an den Client zurückgegeben. Verwenden Sie die Gruppenrichtlinien-Verwaltungskonsole oder das Snap-In "Zertifikate", um Clients mit Informationen dieses Zertifikatregistrierungsrichtlinien-Webdiensts zu konfigurieren.

Continue reading "Details of the event with ID 20 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 19 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:19 (0x13)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Error
Event text (English):The Certificate Enrollment Policy Web Service cannot operate because Windows authentication is not compatible with key based renewal. To resolve this issue, remove the Certificate Enrollment Policy Web Service. Reconfigure the Setup options to disable key based renewal, or select either user name and password authentication or client certificate authentication, and then run Setup again.
Event text (German):Der Zertifikatregistrierungsrichtlinien-Webdienst kann nicht ausgeführt werden, da die Windows-Authentifizierung nicht mit schlüsselbasierter Erneuerung kompatibel ist. Entfernen Sie den Zertifikatregistrierungsrichtlinien-Webdienst, um das Problem zu beheben. Konfigurieren Sie die Setupoptionen neu, um die schlüsselbasierte Erneuerung zu deaktivieren, oder wählen Sie entweder eine Benutzernamen-/Kennwortauthentifizierung oder eine Clientzertifikatauthentifizierung aus, und führen Sie Setup dann erneut aus.

Continue reading "Details of the event with ID 19 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 18 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:18 (0x12)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Information
Event text (English):For a list of the OIDs which are loaded please refer to the "Details" pane.
Event text (German):Eine Liste der geladenen OIDs finden Sie im Detailbereich.

Continue reading "Details of the event with ID 18 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 17 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:17 (0x11)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Information
Event text (English):A certification authority %1 has been loaded. For additional information, please refer to the EventData section of the Details pane.
Event text (German):Die Zertifizierungsstelle "%1" wurde geladen. Weitere Informationen finden Sie im Bereich "Ereignisdaten" des Detailbereichs.

Continue reading "Details of the event with ID 17 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 9 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:9 (0x9)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Error
Event text (English):The Active Directory certificate enrollment policy provider failed to obtain policy information from Active Directory Domain Services (AD DS). The provider will attempt to read the information again in %1 milliseconds. If the problem persists, enable tracing in the web.config file, enable logging by using "certutil -setreg debug 0xffffffe3", restart IIS by using iisreset.exe, attempt to obtain policy information from any client, and then contact Microsoft Customer Service and Support with the information in the trace files and certenroll.log file. %2
Event text (German):Der Active Directory-Zertifikatregistrierungsrichtlinien-Anbieter konnte die Richtlinieninformationen von den Active Directory-Domänendiensten nicht abrufen. In "%1" Millisekunden wird versucht, die Informationen erneut zu lesen. Falls das Problem weiterhin besteht, aktivieren Sie in der Datei "web.config" die Ablauferfolgung, aktivieren Sie mithilfe von "certutil -setreg debug 0xffffffe3" die Protokollierung, starten Sie IIS neu, rufen Sie von einem beliebigen Client Richtlinieninformationen ab, und wenden Sie sich dann mit den Informationen der Ablaufverfolgungsdateien und der Datei "certenroll.log" an den Microsoft Kundendienst und Support. %2

Continue reading "Details of the event with ID 9 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 8 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:8 (0x8)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Error
Event text (English):The Active Directory certificate enrollment policy provider failed to initialize. Try to restart Internet Information Services (IIS) by using iisreset.exe. If the problem persists, enable tracing in the web.config file, restart IIS, attempt to obtain policy information from any client, and then contact Microsoft Customer Service and Support with the trace file information. %1
Event text (German):Fehler beim Initialisieren des Active Directory-Zertifikatregistrierungsrichtlinien-Anbieters. Starten Sie Internetinformationsdienste (IIS) durch Ausführen von "iisreset.exe" neu. Falls das Problem weiterhin besteht, aktivieren Sie in der Datei "web.config" die Ablaufverfolgung, starten Sie IIS neu, rufen Sie von einem beliebigen Client Richtlinieninformationen ab, und wenden Sie sich dann mit den Informationen der Ablaufverfolgungsdatei an den Microsoft Kundendienst und Support. %1

Continue reading "Details of the event with ID 8 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 16 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:16 (0x10)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Information
Event text (English):A certificate template %1 has been loaded. For additional information, please refer to the EventData section of the Details pane.
Event text (German):Die Zertifikatvorlage "%1" wurde geladen. Weitere Informationen finden Sie im Bereich "Ereignisdaten" des Detailbereichs.

Continue reading "Details of the event with ID 16 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 15 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:15 (0xF)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Error
Event text (English):The URI %2 used by the Certificate Enrollment Web Service for certification authority (CA) "%1" is invalid. Use Server Manager to configure the Certificate Enrollment Web Service to use a valid CA. %3
Event text (German):Der vom Zertifikatregistrierungs-Webdienst für die Zertifizierungsstelle "%1" verwendete URI "%2" ist ungültig. Konfigurieren Sie mit Server-Manager den Zertifikatregistrierungs-Webdienst zum Verwenden einer gültigen Zertifizierungsstelle. %3

Continue reading "Details of the event with ID 15 of the source Microsoft-Windows-EnrollmentPolicyWebService"

Details of the event with ID 14 of the source Microsoft-Windows-EnrollmentPolicyWebService

Event Source:Microsoft-Windows-EnrollmentPolicyWebService
Event ID:14 (0xE)
Event log:Microsoft-Windows-EnrollmentPolicyWebService/Admin
Event type:Error
Event text (English):The certification authority (CA) "%1" associated with the template "%2" cannot be sent as part of the policy response. Confirm that the CA is running and that at least one Certificate Enrollment Web Service is configured to use this CA. %3
Event text (German):Die mit der Vorlage "%2" verknüpfte Zertifizierungsstelle "%1" kann nicht als Teil der Richtlinienantwort gesendet werden. Stellen Sie sicher, dass die Zertifizierungsstelle ausgeführt wird und mindestens ein Zertifikatregistrierungs-Webdienst für die Verwendung dieser Zertifizierungsstelle konfiguriert wurde. %3

Continue reading "Details of the event with ID 14 of the source Microsoft-Windows-EnrollmentPolicyWebService"