Tag: Kerberos

The Active Directory Certificate Services offer a number of web-based add-on interfaces (Network Device Enrollment Service (NDES) , Certificate Enrollment Policy Web Service (CEP) , Certificate Enrollment Web Service (CES) , Certification Authority Web Enrollment (CAWE) .

The Microsoft Internet Information Services (IIS) are thus almost indispensable for a Microsoft PKI. Each of the web-based interfaces (and also in-house developments) bring their own unique challenges in terms of authentication procedures and their implementation.

The following article should bring a little clarity to the topic.

Continue reading "Basics: Authentication procedures for the Internet Information Services (IIS)"

Many companies pursue the strategy of (largely) disabling the NT LAN Manager (NTLM) authentication protocol in their networks.

This is also possible for the administration web page of the Network Device Enrollment Service (NDES). How exactly this is implemented and how this may change the application behavior is explained below.

Continue reading "Disabling NTLM and enforcing Kerberos at the Network Device Enrollment Service (NDES) administration web page"

With the May 10, 2022 patch, Microsoft is attempting to close a vulnerability in Active Directory that affects certificate-based logon (commonly known as PKINIT or also smart card logon ).

The update changes both the behavior of the certification authority as well as the behavior of Active Directory when processing certificate-based logons.

Continue reading "Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754)"

Assume the following scenario:

• You want to establish a remote desktop connection.
• The client computer from which the connection is made is not a member of the same Active Directory forest as the target computer.
• The connection fails with the following error message:

A user account restriction (for example, a time-of-day restriction) is preventing you from logging on. For assistance, contact your system administrator or technical support.

Continue reading "No remote desktop logon possible from outside the Active Directory forest"

Assume the following scenario:

• Users (or computers) should request certificates via the Certificate Enrollment Policy Web Service (CEP).
• For this purpose, a certificate enrollment policy is configured, which points to a Certificate Enrollment Policy Web Service (CEP).
• Authentication is done via Kerberos.
• When checking the address, the connection to the CEP fails and you get the following error message:

An error occurred while obtaining certificate enrollment policy.
 Url: https://cews.adcslabor.de/ADCS%20Labor%20Issuing%20CA%201_CES_Kerberos/service.svc/CES
 Error: A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)

Continue reading "Certificate enrollment policy check via the Certificate Enrollment Policy Web Service (CEP) fails with error code "WS_E_ENDPOINT_FAULT_RECEIVED""

After installing a Certificate Enrollment Policy Web Service (CEP), or after more extensive maintenance work, an extensive functional test should be performed to ensure that all components are working as desired.

Continue reading "Performing a functional test for the Certificate Enrollment Policy Web Service (CEP)"

The following describes how to install the Certificate Enrollment Policy Web Service (CEP).

Continue reading "Installing a Certificate Enrollment Policy Web Service (CEP)"

Assume the following scenario:

• A user requests a certificate.
• An enrollment policy is configured for this, which points to a Certificate Enrollment Policy Web Service (CEP).
• Authentication is done via Kerberos.
• The certificate is requested from the CEP server itself.
• The connection to the CEP fails and the user receives the following error message:

Error: A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)

Continue reading "Requesting a certificate via the Certificate Enrollment Web Services fails with error message "Error: A message containing a fault was received from the remote endpoint. 0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED)""