Re: Microsoft PKI: problem with autoenrollment for domain controllers
- From: "Brian Komar" <brian.komar@xxxxxxxxxxxxxxxxx>
- Date: Tue, 14 Aug 2007 09:46:29 -0500
Microsoft CAs are hard coded to request the Domain Controller certificate.
WIndows SErver 2003 introduced the Domain Controller AUthentication certificate template, which supercedes the Domain Controller.
My question for you is why you have decided to create your own template, rather than using the defaults?
Brian
"Grovnasch" <Grovnasch.Krabill@xxxxxxxxx> wrote in message news:1187095866.051441.16740@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Hello everybody,
I have the following problem on my AD-Domain (3 Domain Controllers
with MS-PKI):
all the domain controllers have recurrent errors in the Application
Event Viewer that say:
"Automatic Certificate Enrollment for local system could not find a
valid certificate templete to match DomainControlleras specified in
the group policy automatic enrollment object. Enrollment will not be
performed."
The "DomainController" template is the standard template, which I have
removed from the "Certificta templates to issue" container. Besides, I
have created a new personnalized DomainController template, called
MyDomainController, which is accepted by all the CDs, i.e. all the 3
of them have been issued a valid certificate. Nevertheless, all domain
controllers still ask for a "DomainController" Certificate, although
there is no entry at all in the Default Domain Controller Policy (-->
Computer Settings --> Windows Settings --> Security Settings -->
Public Key Policies --> Automatic Certificate Request Settings).
If I try to reintegrate the "DomainController" template on the CA to
--
Certificate Authority --> My CA --> Certificate Templates: New CertTemplate to issue, I get the following error: "The template
information on the CA cannot be modified at this time. This is most
likely because the CA service is not running or these are replication
delays. One or more certificate templates to be enables on this
certificate authority could not be found. The changes can be saved to
Active Directory and retrieved by the CA next time it is started. Do
you want to save the changes to Active Directory?".
Clicking "Yes" and restarting the CA does not solve the problem...
Did anyone have the same problem? Any ides?
Thanks in advance,
.
- Follow-Ups:
- References:
- Prev by Date: Microsoft PKI: problem with autoenrollment for domain controllers
- Next by Date: Permit only one network logon per user
- Previous by thread: Microsoft PKI: problem with autoenrollment for domain controllers
- Next by thread: Re: Microsoft PKI: problem with autoenrollment for domain controllers
- Index(es):
Relevant Pages
|
