Subordinate CAs issuing multiple certificates through auto-enrollment

-

i have offline root ca; , 2 subordinate cas (one in hq , 1 in dr) both running , active services installed directly on them.

i have configured group policy auto-enroll using these 2 servers; , have configured 2003 certificate template (copy of computer template) client authentication used wireless access.

when apply policy, find computers enrolling mutliple times in "issued certificates" store; in local store see 1 certificate; , have enabled in template feature "do not automatically reenroll if duplicate certificate exists in active directory" some how has not prevented re-enrolling , disaster both sub-cas re-enrolling each computer, computer getting 1 certificate each subordinate ca.

this urgent, ideas helpful

+--+--+--+--+--+--+--+--+--+--+ hany elkady infrastructure consultant +--+--+--+--+--+--+--+--+--+--+


ok, have figured out. searches in future...

  1. windows xp incompatible windows 2008 r2 gpos , breaks lots of things if gpo created 2008 r2 if forest 2008 or 2003
  2. windows xp needs hotfix allow enrol 2003/2008 templates (i.e. version 2 & 3) if hotfix not installed, facing above; computer enrolles in 1 subca , not able save certificate because doesn't understand hash algorithim; requests second subca, , same thing happens again. next time user logs in or pulse happen, same process repeated. along subcas have been issuing certificates no problems computer has not been reading them.
  3. i have not enabled again ad checking or saving, , have wait until deploy hotfix through sccm first before can that; in meantime, have created 2 group policies, 1 allowing windows vista & 7 machines autoenroll normal 2003 certs; , other xp machines allow them pick standard computer certificate.

n.b. looking again, hotfix xp , 2003 machines can found @ kb968730

+--+--+--+--+--+--+--+--+--+--+ hany elkady infrastructure consultant +--+--+--+--+--+--+--+--+--+--+



Windows Server  >  Security



Comments

Post a Comment

Popular posts from this blog

CRL Revocation always failed

-
hi all, i try configure radius server nps, somehow certificate authentication client failed with reason: reason = revocation function unable check revocation because revocation server offline. then check certificate client, certutil -f -urlfetch -verify client7.cer, result follow: issuer:     cn=entca     dc=intra     dc=domain     dc=co     dc=sg subject:     cn=computer.intra.domain.co.sg cert serial number: 1c5b00de000000000041 dwflags = ca_verify_flags_allow_untrusted_root (0x1) dwflags = ca_verify_flags_ignore_offline (0x2) dwflags = ca_verify_flags_full_chain_revocation (0x8) dwflags = ca_verify_flags_console_trace (0x20000000) dwflags = ca_verify_flags_dump_chain (0x40000000) chainflags = cert_chain_revocation_check_chain (0x20000000) hcce_local_machine cert_chain_policy_base -------- cert_chain_context -------- chaincontext.dwinfostatus = cert_trust_has_preferred_issuer (0x100) chaincontext.dwerrorstatus = cert_trust_revocation_sta
Read more

Failed to query the results of bpa xpath

-
Image
i have new server installed hyper v, iis , domain services roles on it.  i checking event log , see warning multiple times, idea how rid of it?? failed query results of bpa xpath: microsoft/windows/fileservices:$reports$\*\result.xml:/resultdatabase/result. error: device attached system not functioning., last error: system cannot find path specified.. follow me on twitter <<< levalencia blog <<< hi, similar issue discussed in forum: to rid of warnings: 1. go dashboard 2. click on add roles , features 3. click next "before begin step" 4. select "role based or feature based installation" , click next 5. select given server server pool , click next 6. in server roles step make sure following checked:   file , storage services > file , iscsi services > file server, click next 7.click next through rest of steps , install server role 8. rerun bpa scan described earlier for more information please refer following ms
Read more

0x300000d errors in Microsoft Remote Desktop client

-
we use rd connect home users office. @ server side remote desktop gateway configured on 2008r2 server. experience following:   for years worked fine, starting last year users apple macbook experienced connection errors after new version of microsoft remote desktop in app store , automatic update. after couple of weeks error disappaered when new updates released. since 6 8 weeks problem again. because don’t have macbook cannot reproduce problem.   starting couple of weeks samsung s6 experiencing problems, here version 8.1.37.135 installed, error displayed is: can’t connect tot remote pc because remote desktop gateway server temporaraily unavailable. try connecting later or contact network administrator assistance. error code  0x300000d   because has worked fine years expect issues on client can configuration error on gateway server.   who pin point real cause?   however, testing other rd gateway server works ok settings identically. hi ruud, as works rd
Read more