Activer la journalisation pour la demande automatique de certificat (auto-enrollment)

Auteur Uwe GradeneggerPublié le Catégories Événements, DépannageÉtiquettes

Nachfolgend eine Übersicht über die für die von Windows-Zertifikat-Clients erzeugten Ereignisse in der Windows-Ereignisanzeige, deren Aktivierung und deren Identifikation.

Connaissez-vous TameMyCerts? TameMyCerts est un add-on pour l'autorité de certification Microsoft (Active Directory Certificate Services). Il étend la fonction de l'autorité de certification et permet de Application de la réglementationIl s'agit d'un logiciel de gestion des certificats qui permet d'automatiser l'émission de certificats en toute sécurité. TameMyCerts est unique dans l'écosystème Microsoft, a déjà fait ses preuves dans d'innombrables entreprises du monde entier et est disponible sous une licence libre. Il peut téléchargé via GitHub et être utilisé gratuitement. Une maintenance professionnelle est également proposée.

Protokollierung konfigurieren

Damit Ereigniss, die über Fehler und Warnungen hinausgehen, protokolliert werden, muss im betreffenden Bereich (je nachdem, ob es sich um ein Benutzer- oder Computerzertifikat handelt) eine „LogLevel“ Direktive (analog zur Zertifizierungsstelle) mit entsprechendem Inhalt angelegt werden.

Die LogLevel Direktive ersetzt die zuvor verwendete AEEventLogLevel Direktive.

Chemin d'accèsDescription
HKCU\Logiciel\Microsoft\Cryptography\AutoEnrollmentParamètres utilisateur, configurés localement
HKLM\Logiciel\Microsoft\Cryptography\AutoEnrollmentParamètres de l'ordinateur, configurés localement

Mit folgendem Kommandozeilenbefehl kann die erweiterte Protokollierung für den Benutzer- als auch den Systemkontext konfiguriert werden. Es werden alle Ereignisse der Typen „Error“, „Warning“ und „Information“ ausgegeben.

certutil –setreg Enroll\LogLevel 4

L'augmentation du niveau de journalisation peut générer un grand nombre d'événements. Il faut donc s'assurer que le journal des événements peut croître en conséquence. Dans le cas contraire, les événements antérieurs seront écrasés. Il est conseillé de n'augmenter le niveau de journalisation que temporairement.

Die Änderungen werden direkt ohne Neuanmeldung bzw. Neustart aktiv.

Das Setzen des Schlüssels im Benutzerkontext mit dem Parameter -user hat keine Auswirkungen.

Les valeurs numériques sont traduites dans les variables suivantes :

ValeurSignificationNotes
0CERTLOG_MINIMAL
1CERTLOG_TERSE
2CERTLOG_ERROR
3CERTLOG_WARNINGAktiviert zusätzlich Ereignisse des Levels „Warning“
(réglage par défaut)
4CERTLOG_VERBOSEAktiviert zusätzlich Ereignisse des Levels „Information“
5CERTLOG_EXHAUSTIF

Das Zurücksetzen der Protokollierung auf die Standardwerte wird durch löschen des zuvor angelegten Schlüssels erreicht.

certutil –delreg Enroll\LogLevel

Sources d'événements

  • Microsoft-Windows-CertificateServicesClient-AutoEnrollment
  • Microsoft-Windows-CertificateServicesClient
  • Microsoft-Windows-CertificateServicesClient-CertEnroll

Événements

Microsoft-Windows-CertificateServicesClient-AutoEnrollment

Mit folgendem Windows PowerShell Befehl können die Ereignisse ausgelesen werden:

Get-WinEvent -FilterHashtable @{
  Logname='Application'
  ProviderName='Microsoft-Windows-CertificateServicesClient-AutoEnrollment'
}
IDTypeTexte de l'événement
1InformationAutomatic certificate enrollment for %1 failed to download certificates for %2 store from %3 (%4). %5
2InformationAutomatic certificate enrollment for %1 started.
3InformationAutomatic certificate enrollment for %1 completed.
4InformationAutomatic certificate enrollment for %1 invoked the enrollment API.
5InformationAutomatic certificate enrollment for %1 returned from the enrollment API.
6ErreurAutomatic certificate enrollment for %1 failed (%2) %3.
15AvertissementAutomatic certificate enrollment for %1 failed to contact the active directory (%2). %3 Enrollment will not be performed.
64AvertissementCertificate for %1 with Thumbprint %2 is about to expire or already expired.

Microsoft-Windows-CertificateServicesClient

Mit folgendem Windows PowerShell Befehl können die Ereignisse ausgelesen werden:

Get-WinEvent -FilterHashtable @{
  Logname='Application'
  ProviderName='Microsoft-Windows-CertificateServicesClient'
}
IDTypeTexte de l'événement
1InformationCertificate Services Client has been started successfully.
2InformationCertificate Services Client has been stopped.
3InformationCertificate Services Client has detected network connectivity.
4InformationCertificate Services Client has detected network dis-connectivity.
501AvertissementCertificate Services Client is triggered with bad parameters: %1.
502AvertissementCertificate Services Client failed to register Group Policy notifications. Error code: %1.
1001ErreurCertificate Services Client failed to load Provider %1. Error code %2.
1002ErreurCertificate Services Client cannot find the required interface in Provider %1. Error code %2.
1003ErreurCertificate Services Client failed to invoke the Providers in response to event %1. Error code %2.
1004ErreurCertificate Services Client Provider %1 raised an exception. Exception code %2.

Microsoft-Windows-CertificateServicesClient-CertEnroll

Mit folgendem Windows PowerShell Befehl können die Ereignisse ausgelesen werden:

Get-WinEvent -FilterHashtable @{
  Logname='Application'
  ProviderName='Microsoft-Windows-CertificateServicesClient-CertEnroll'
}
IDTypeTexte de l'événement
4InformationL'inscription au certificat pour %1 n'a pas permis d'accéder aux ressources locales ou de récupérer les informations du modèle de certificat %2 (%3). L'enrôlement n'a pas été effectué.
5InformationCertificate enrollment for %1 could not find any valid certificate templates. Enrollment was not performed.
6ErreurCertificate enrollment for %1 could not find a valid certificate template to match %2. Enrollment was not performed.
9ErreurCertificate enrollment for %1 was denied by %3 when retrieving the pending request for a %2 certificate with request ID %4.
10InformationInscription de certificats pour %1 archivés ou supprimés, à partir du magasin de certificats personnels, certificats expirés, révoqués ou remplacés.
11AvertissementCertificate enrollment for %1 could not find a certification authority in the enterprise. Enrollment was not performed.
13ErreurL'inscription au certificat pour %1 a échoué pour un certificat %2 avec l'ID de demande %4 de %3 (%5).
14SuccessCertificate enrollment for %1 received a %2 certificate with request ID %4 from %3 when retrieving pending requests.
15AvertissementCertificate enrollment for %1 failed to retrieve certificate template information from the Policy Server. Enrollment was not performed.
16ErreurCertificate enrollment for %1 failed to renew a %2 certificate with request ID %4 from %3 (%6). The certificate which failed to renew is %5
17AvertissementCertificate enrollment for %1 failed to enroll for a %2 certificate from certification authority %3 (%4). Another certification authority will be contacted.
18AvertissementCertificate enrollment for %1 failed to renew a %2 certificate from certification authority %3 (%4). Another certification authority will be contacted.
19InformationCertificate enrollment for %1 successfully received a %2 certificate with request ID %4 from certification authority %3.
20InformationCertificate enrollment for %1 successfully renewed a %2 certificate with request ID %4 from certification authority %3.
21SuccessCertificate enrollment for %1 attempted to enroll for a %2 certificate with request ID %4 from certification authority %3. The request is pending.
22SuccessCertificate enrollment for %1 attempted to renew a %2 certificate with request ID %4 from certification authority %3. The request is pending.
25InformationCertificate enrollment for %1 failed to update the %2 certificate in the Personal certificate store due to one of the following: Cannot find %2 certificate template from Active Directory. Enrollment access to this template is not allowed.
27InformationCertificate enrollment for %1 was cancelled by the user.
30InformationCertificate enrollment for %1 was cancelled by the user when requesting a %2 certificate.
32InformationCertificate enrollment for %1 attempted to retrieve a %2 certificate from %3. The certificate request is still pending.
33InformationCertificate enrollment for %1 deleted certificates that have expired, or have been revoked or superseded from the user object in Active Directory.
35ErreurCertificate enrollment for %1 detected that the DNS name in the %2 certificate does not match the DNS name of the local computer. A new enrollment for a %2 certificate will be attempted in %3 hours.
36ErreurCertificate enrollment for %1 detected that the DNS name in the %2 certificate does not match the DNS name of the local computer. No more enrollments for %2 certificates will be attempted until the current certificate is revoked or expires because the same error has occurred %3 times.
38AvertissementCertificate enrollment for %1 cannot enroll or renew %2 certificate because user interaction is required on the %2 template in Active Directory.
41InformationTo prevent simultaneous renewal or enrollment from another computer, certificate enrollment for %1 to renew or enroll for a %2 certificate has been skipped.
42AvertissementCertificate enrollment for %1 for the %2 template must be performed by using the machine context.
43AvertissementCertificate enrollment for %1 failed to find a smart card reader for the %2 template. Enrollment will not be performed.
44AvertissementCertificate enrollment for %1 failed to open the user interface (%2).
45ErreurCertificate enrollment for %1 failed to create an enrollment request for a %2 certificate (%3).
46AvertissementCertificate enrollment for %1 could not enroll for a %2 certificate. Read or enrollment access is not allowed for this template.
47AvertissementCertificate enrollment for %1 could not enroll for a %2 certificate. A valid certification authority cannot be found to issue this template.
48AvertissementCertificate enrollment for %1 could not enroll for a %2 certificate. Signature requirements for the certificate cannot be met.
50AvertissementCertificate enrollment for %1 failed to install the certificate response for a %2 certificate with request ID %3 (%4).
51AvertissementCertificate enrollment for %1 for the %2 certificate must be performed under the user context.
52AvertissementThe CA certificate for %3 is not trusted. Certificate enrollment for %1 for a %2 certificate failed.
53AvertissementCertificate enrollment for %1 failed to retrieve a %2 certificate from certification authority %3 with request ID %4, and the error returned from the server is %5. Another certification authority will be contacted.
54AvertissementCertificate enrollment for %1 failed to retrieve a pending %2 certificate with request ID %4 from certification authority %3 (%5). The enrollment process will be attempted again later.
55AvertissementCertificate enrollment for %1 for the %2 template could not find specified CSPs on the local machine. Enrollment will not be performed.
56InformationCertificate enrollment for %1 for the template %2 was not performed because this template has been superseded.
57AvertissementLe fournisseur „%2“ n'a pas été chargé car l'initialisation a échoué.
58AvertissementThe „%3“ algorithm for the „%2“ provider was not loaded because initialization failed.
59AvertissementCould not determine the signature algorithm for %2 to sign an enrollment request.
60AvertissementCould not find a registered public key algorithm OID for %2 for an enrollment request.
61AvertissementCould not find a registered signature algorithm OID for %1 and %2 to sign an enrollment request.
62AvertissementCould not encode signature parameters for a %2 signature for an enrollment request.
63AvertissementEnrollment Policy Server %2 returned an error when retrieving templates for %1: %3
64AvertissementCertificate enrollment for %1 successfully load policy from policy server %2
65AvertissementCertificate enrollment for %1 is successfully authenticated by policy server %2 using authentication mechanism %5 (Credential: %4). Policy Id: %3
66AvertissementCertificate enrollment for %1 is successfully authenticated by enrollment server %2 using authentication mechanism %5 (Credential: %4). Policy Id: %3
67AvertissementCertificate enrollment for %1 failed to load policy from policy servers with ID %2 (%3)
68AvertissementCertificate enrollment for %1 failed in authentication to policy servers with ID %2 (%3)
70AvertissementCertificate enrollment for %1 failed because no valid policy can be obtained from policy servers with ID %2
71AvertissementCertificate enrollment for %1 failed in adding credential to Vault for %2 (%3)
72AvertissementCertificate enrollment for %1 failed because the loaded policy from the policy server %2 is invalid (%3)
73AvertissementCertificate auto enrollment for %1 cannot be done because the policy server %2 turns it off.
74AvertissementCertificate enrollment for %1 failed to load policy from policy server %2 with ID %3 (%4)
75AvertissementCertificate enrollment for %1 failed in authentication to policy server %2 with ID %3 (%6). Authentication mechanism was %5 (Credential: %4)
76AvertissementCertificate enrollment for %1 failed in authentication to enrollment server %2 (%6). Policy Id: %3. Authentication mechanism was %5 (Credential: %4)
77AvertissementCertificate enrollment for %1 cannot enroll from user configured enrollment policy server since it is disabled by group policy
78AvertissementCertificate enrollment for %1 sent a request for template %2 to a ROBO certificate enrollment server %3
79AvertissementCertificate enrollment for %1 sent a request for template %2 to a ANONYMOUS certificate enrollment server %3
80AvertissementCertificate enrollment for %1 cannot enroll for a %2 certificate because the certificate enrollment server %3 is ROBO and only renewal is supported
81AvertissementCertificate enrollment for %1 cannot enroll for a %2 certificate because the certificate enrollment server %3 is ANONYMOUS and only renewal is supported
82AvertissementL'inscription au certificat pour %1 a échoué dans l'authentification à toutes les url pour le serveur d'inscription associé à l'identifiant de politique : %2 (%4). Echec de l'inscription pour le modèle : %3
83AvertissementCertificate enrollment for %1 cannot find a credential that meets the selection criteria for url %2 with id %3 (%4)
84AvertissementThe credential for URL %2 has been updated from certificate (%4) to certificate (%3) in context %1
85AvertissementCertificate enrollment for %1 for the %2 template could not perform attestation due to an error with the cryptographic hardware using the provider: %3. Request Id: %4.%5
86ErreurSCEP Certificate enrollment initialization for %1 via %2 failed: %3 Method: %4 Stage: %5 %6
87ErreurSCEP Certificate enrollment for %1 via %2 failed: %3 Method: %4 Stage: %5 %6
88InformationSCEP Certificate enrollment for %1 via %2 succeeded: %3 Method: %4 Stage: %5
89ErreurCould not find a Logon Certificate Template for %1 Template: %2 State: %3 Process: %4 %5
90ErreurFound multiple Logon Certificate Templates for %1 Templates: %2 State: %3 Process: %4 %5
91InformationSuccessfully found Logon Certificate Template for %1 Template: %2 State: %3 Process: %4
92ErreurLogon Certificate Request creation for %1 failed for the %2 template for key %3 %4 Process: %5 %6
93InformationLogon Certificate Request creation for %1 succeeded for the %2 template for key %3 Request thumbprint: %4 Process: %5
94ErreurFailed to install Logon Certificate for %1 failed Request thumbprint: %2 Thumbprint: %3 %4 Process: %5 %6
95InformationSuccessfully installed Logon Certificate for %1 Request thumbprint: %2 Thumbprint: %3 Process: %4
96ErreurFailed to remove Logon Certificate request for %1 Request thumbprint: %2 Process: %3 %4
97AvertissementSuccessfully removed Logon Certificate request for %1 Request thumbprint: %2 Process: %3
98ErreurFailed to import PFX Certificate for %1 Flags: %2 Provider: %3 Container: %4 Process: %5 %6

Liens complémentaires :

Sources externes

Les commentaires sont fermés.

fr_FRFrançais
de_DEDeutsch en_USEnglish fr_FRFrançais