Tag: Group Policy

Assume the following scenario:

• The company would like to use smart card logon.
• The domain controllers are equipped with certificates that can be used for smart card logon .
• The users are equipped with certificates that can be used for smart card logon.
• Logon to the domain via smart card fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Smart card logon fails with error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""

I recently encountered the phenomenon that due to a faulty request logic, several users had made new certificate requests at regular intervals.

The certificate template was configured to have incoming certificate requests approved by a certificate manager, i.e., certificates were not issued automatically. Certificate requests were to be checked using a separate code and then approved.

One would now expect that (since all certificate requests would eventually be approved) users would now find multiple certificates of the same type in their certificate store (and the applications that use it). However, this was not the case.

Continue reading "What happens if a user has requested multiple certificates?"

Assume the following scenario:

• Machines are configured by Group Policy to request certificates for the Remote Desktop Session Host .
• However, the certificates are not requested.
• In the event log of the affected system, the event with ID 1064 of the source Terminalservices-RemoteConnectionManager is logged:

The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occurred: The permissions on the certificate template do not allow the current user to enroll for this type of certificate.

Continue reading "Requesting Remote Desktop certificates fails with error message "The permissions on the certificate template do not allow the current user to enroll for this type of certificate.""

Assume the following scenario:

• Machines are configured by Group Policy to request certificates for the Remote Desktop Session Host .
• However, the certificates are not requested or existing certificates expire without renewal.
• In the event log of the affected system, the event with ID 1064 of the source Terminalservices-RemoteConnectionManager is logged:

The RD Session Host server cannot install a new template-based certificate to be used for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption. The following error occurred: The requested certificate template is not supported by this CA.

Continue reading "Remote desktop certificate request fails with error message "The requested certificate template is not supported by this CA.""

Assume the following scenario:

• A certificate template is configured for automatic certificate request (autoenrollment).
• The certificate template is published on a certification authority (Enterprise Certification Authority) integrated into Active Directory.
• However, the users or computers configured for automatic certificate request do not request certificates as intended.

The following is a troubleshooting guide.

Continue reading "Troubleshooting for automatic certificate request (autoenrollment) via RPC/DCOM (MS-WCCE)"

Assume the following scenario:

• A Windows role related to Active Directory Certificate Services (Certification Authority, Network Device Enrollment Service (NDES), Certification Authority Web Enrollment (CAWE), Certificate Enrollment Web Services (CEP, CES), or Online Responder (OCSP)) is to be installed or uninstalled.
• The installation or uninstallation fails with the following error message:

The status of the role services on the target machine cannot be determined. Please retry. The error is The WS-Management service cannot process the request. The service is configured to not accept any remote shell requests.

Continue reading "Installation or uninstallation of a Windows feature fails with error message "The service is configured to not accept any remote shell requests.""

A useful hardening measure for certification authorities is to restrict the certification authority certificates so that they are only trusted for the extended key usages (Extended Key Usage) actually issued.

In the event of a compromise of the certification authority, the damage is then limited to these Extended Key Usages. The smart card logon extended key usage would then only be present in the certification authority certificate of the certification authority that actually issues such certificates.

Continue reading "Restrict Extended Key Usage (EKU) for imported root certification authority certificates"

Continue reading "Configuration of security event monitoring (auditing settings) for certification authorities"

Once a Group Policy with audit settings is active, the default auditing rules preconfigured with the operating system are turned off and only the explicitly configured audit settings are applied.

Continue reading "Standard auditing rules for Windows Server operating systems"

If you have configured a certificate template for Remote Desktop certificates and an appropriate Group Policy , or manually assigned a Remote Desktop certificate , you may want to verify that the certificates on the participating computers are being used correctly by the Remote Desktop session host.

Continue reading "Identify the active Remote Desktop (RDP) certificate"

After configuring a certificate template for the distribution of Remote Desktop certificates (see the article "Configuring a Certificate Template for Remote Desktop (RDP) Certificates "), a Group Policy is still required that instructs the participating computers to also use the certificates originating from the template.

Continue reading "Configuring a Group Policy (GPO) for Remote Desktop (RDP) Certificates"

Assume the following scenario:

• Client computers automatically obtain certificates from an Active Directory integrated certification authority (Enterprise Certification Authority).
• Expiring certificates are renewed automatically when the clients are on the internal network.
• However, expiring certificates are not automatically renewed when clients are connected via Virtual Private Network (VPN).
• This can result in clients not renewing their certificate in time before it expires and no longer being able to connect to the VPN.

Continue reading "Clients connected via Virtual Private Network (VPN) do not renew certificates automatically"

Here's the scenario:

• A user requests a certificate from an Active Directory integrated certification authority (enterprise CA).
• The certificate of the certification authority is trusted, i.e. it is located in the Trusted Root Certification Authorities store.
• The certificate request fails with the following error message:

A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Requesting a certificate fails with the error message "A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)""