Installation of a certification authority certificate fails with error message "Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)"

Author Uwe Gradenegger Posted on Updated on Categories Troubleshooting, Active Directory, Certification Authority Tags ERROR_DS_INSUFF_ACCESS_RIGHTS

Assume the following scenario:

  • A certification authority (Enterprise Certification Authority) integrated into Active Directory is installed.
  • Delegated permissions are used to install the certification authority. Thus, the installing user is not a member of the "Enterprise Administrators" group.
  • After the certification authority certificate is issued by the parent certification authority, it is installed to complete the role configuration.
  • The installation of the certification authority certificate fails with the following error message:
Insufficient access rights to perform the operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Error dialog "Microsoft Active Directory Certificate Services": "Insufficient access rights to perform the operation." 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTS)

Cause

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

This error occurs when the installing user does not have write permission to the NTAuthCertificates object in the Active Directory forest.

The certification authority certificate is added to this object during installation - even if it is to be removed again directly afterwards , this step cannot be skipped.

Follow-up error: duplicate certification authority certificate

If you run into the error, you will have to go through the process of installing the certification authority certificate again. Unfortunately, this will cause the certificate to be entered into the certification authority configuration multiple times, and the certification authority service will refuse to start with the error code ERROR_INVALID_DATA .

Error dialog "Microsoft Active Directory Certificate Services": "The data is invalid." 0xd (WIN32: 13 ERROR_INVALID_DATA)

To remove the multiple instances, the duplicate entries must be removed from the CACertHash registry key. This is located in the following location:

HKLM\System\CurrentControlSet\Services\CertSvc\Configuration\{Common-Name-der-Zertifizierungsstelle}

Registry Editor: context menu "Modify..." for the value CACertHash under CertSvc\Configuration\ADCS Labor Test

Duplicate entries must be removed.

Dialog "Edit Multi-String": value CACertHash with two lines of the same hash, the second one selected

Afterwards, the certification authority service must be restarted.

Please note that there will also be two copies of the same certification authority certificate under C:\Windows\System32\CertSrv\CertEnroll.