In the context of hardening measures, it is a good idea to apply the Microsoft Security Baselines published by Microsoft to your own server landscape.
This will inevitably have an impact on PKI components. The following is an overview of the expected effects and countermeasures.
Continue reading "What to consider when applying Microsoft Security Baselines?"
Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will have an impact on the CEP components.
If, in addition to Active Directory Certificate Services, the administrative tiering model is also implemented for the Active Directory directory service, the question arises as to how the individual PKI components are to be assigned to this model in order to be able to perform targeted security hardening.
Continue reading "Classification of AD CS components in the Administrative Tiering Model"
Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will impact the CES components.
Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will impact Certification Authority Web Enrollment (CAWE).
Assume the following scenario:
The remote endpoint could not process the request. 0x803d000f (-2143485937 WS_E_ENDPOINT_FAILURE)As part of security hardening efforts against the Active Directory directory service, the question of why Active Directory integrated certification authorities (Enterprise Certification Authority) are members of the Pre-Windows 2000 Compatible Access security group comes up frequently.
Assuming one implements Microsoft's Active Directory Administrative Tiering Model, or applies similar hardening measures to one's servers, this will have an impact on NDES components.