Assume the following scenario:
Sign-in failed. Contact your system administrator and tell them that the KDC certificate could not be validated. Additional information may be available in the system event log.Since Windows NT 4.0, Cryptographic Service Providers (CSP) have been part of the CryptoAPI.
The idea is that an application does not have to worry about the specific implementation of key management, but can leave this to generic operating system interfaces. This also prevents cryptographic keys from being loaded into the working memory in the security context of the user/application used (a fatal security incident based precisely on this problem was the Heartbleed incident ).
For example, it makes no technical difference to the certification authority software how its private key is protected - whether in software or with a hardware security module (HSM), for example. The call of the private key is always identical for the certification authority.
With Windows Vista and the introduction of Cryptography Next Generation (CNG) as a replacement for CryptoAPI, Key Storage Providers (KSP) were introduced.
Continue reading "Basics: Cryptographic Service Provider (CSP) and Key Storage Provider (KSP)"
| Event Source: | Microsoft-Windows-Security-Auditing |
| Event ID: | 4899 (0x1323) |
| Event log: | Security |
| Event type: | Information |
| Event text (English): | A Certificate Services template was updated. %1 v%2 (Schema V%3) %4 %5 Template Change Information: Old Template Content: %8 New Template Content: %7 Additional Information: Domain Controller: %6 |
| Event text (German): | Die Zertifikatdienstvorlage wurde aktualisiert. %1 v%2 (Schema V%3) %4 %5 Vorlageninformationen: Vorlageninhalt: %7 Sicherheitsbeschreibung: %8 Zusätzliche Informationen: Domänencontroller: %6 |
Installing Active Directory Certificate Services in the default configuration automatically configures the environment so that smart card logons are accepted by the domain controllers.
Therefore, if the use of smart card logons is not desired, it makes sense to disable the functionality in order not to jeopardize Active Directory in the event the certification authority is compromised.
A new feature of Windows Server 2016 is that the passwords for accounts that require pure logon with smart cards are automatically renewed according to the password policies.
If the "Smart card is required for interactive logon" option is enabled for a user account, the password of the user account is set to a random value once. However, the password never changes after that, which makes the account more vulnerable to pass-the-hash attacks.
The newly introduced feature solves this problem by generating new randomly generated passwords for corresponding accounts on a regular basis (depending on the password policy configured for the account).
In the default configuration, all certification authority certificates of Active Directory integrated certification authorities (enterprise CAs) are located in an object of type CertificationAuthority named NTAuthCertificates within the Configuration Partition of the Active Directory forest.
Continue reading "Editing the NTAuthCertificates object in Active Directory"
There are cases where you cannot or do not want to obtain domain controller certificates from a certification authority in your own Active Directory forest.
In this case, the use of certificate templates is not possible, and one must manually create a Certificate Signing Request (CSR).
Continue reading "Manually requesting a domain controller certificate"