Details of the event with ID 74 of the source Microsoft-Windows-CertificationAuthority

Event Source:	Microsoft-Windows-CertificationAuthority
Event ID:	74 (0x4A)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_BASE_CRL_PUBLICATION_HOST_NAME
Event text (English):	Active Directory Certificate Services could not publish a Base CRL for key %1 to the following location on server %4: %2. %3.%5%6
Event text (German):	Failed to publish a base certificate revocation list for key %1 at the following location on server "%4": %2. %3.%5%6

Parameter

The parameters contained in the event text are filled with the following fields:

%1: CAKeyIdentifier (win:UnicodeString)
%2: URL (win:UnicodeString)
%3: ErrorMessageText (win:UnicodeString)
%4: HostName (win:UnicodeString)
%5: param5 (win:UnicodeString)
%6: AdditionalErrorMessage (win:UnicodeString)

Example events

Active Directory Certificate Services could not publish a Base CRL for key 5 to the following location on server DC01.intra.adcslabor.de: ldap:///CN=ADCS Labor Issuing CA 2(5),CN=ADCS Labor Issuing CA 2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=de.  Directory object not found. 0x8007208d (WIN32: 8333 ERROR_DS_OBJ_NOT_FOUND).
 ldap: 0x20: LDAP_NO_SUCH_OBJECT: 0000208D: NameErr: DSID-03100288, problem 2001 (NO_OBJECT), data 0, best match of:
 	'CN=ADCS Labor Issuing CA 2,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=de'

Active Directory Certificate Services could not publish a Base CRL for key 0 to the following location on server DC01.intra.adcslabor.de: ldap:///CN=ADCS Labor Issuing CA 1,CN=ADCS Labor Issuing CA 1,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=intra,DC=adcslabor,DC=de. Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS).
ldap: 0x32: LDAP_INSUFFICIENT_RIGHTS: 00002098: SecErr: DSID-03150F94, problem 4003 (INSUFF_ACCESS_RIGHTS), data 0

Description

This problem occurs when the certificate revocation list could be successfully generated, but subsequently could not be copied to one of the configured revocation list distribution points. Causes for this can be:

Error code ERROR_DS_INSUFF_ACCESS_RIGHTS

See article "Publishing a certificate revocation list (CRL) fails with the error message "Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)".„.

Error code ERROR_DS_OBJ_NOT_FOUND

See article "Publishing a certificate revocation list (CRL) fails with the error message "Directory object not found. 0x8007208d (WIN32: 8333 ERROR_DS_OBJ_NOT_FOUND)".„.

Safety assessment

The security assessment is based on the three dimensions of confidentiality, integrity and availability.

If the certification authority is not able to generate or publish a revocation list, it is highly likely that it will expire on the distribution points in a short time. In this case, there is a threat of failure of the IT services that depend on the PKI. Therefore, this event must be rated as "critical" in terms of availability.

Microsoft rating

Microsoft evaluates this event in the Securing Public Key Infrastructure (PKI) Whitepaper with a severity score of "Low".