Re: Windows 2003 - Child domain cannot request certificate from root domain

Hi,

Thanks for the response. Eventually we got it working. We tried all
kinds of permissios (your tip included)... and at the end of the day
we found out that AD had not replicated permissions throughout the
forest. Even though we completely shutdown and restarted ALL machines
and domain controllers in the lab (several times), we had to force
replication by using mmc snap-in "Active Directory Sites and
Services".

Browse to "Sites > Default-First-Site-Name > Servers > YOUR_ROOT_DC >
NTDS Settings"

Under that, you'll find your child domain controllers. Right click on
each one and select "Replicate Now".

This got it all working. Now we know... all you need is the right
permissions on the certificate template you want to use. Even though
we changed permissions on the template, AD was taking much longer to
replicate these settings throughout the forest (apparently this may
take several hours).

Thanks a lot!
Julio

On Jan 13, 6:49 am, "Brian Komar" <brian.ko...@xxxxxxxxxxxxxxxxx>
wrote:
The main thing is that you have to modify the permissions on the certificate
templates you wish to issue.
By default, permissions assume a single domain forest.
You must change the permissions to allow users and computers from a child
domain to request certificates from the CA>
- The certificate templates are edited using the Certificate Templates
console (certtmpl.msc)
- By default, only Enterprise Admins and forest root Domain Admins have the
permissions to edit the certificate templates.
- The certificate templates are stored in the Configuration naming context
and replicated to all DCs in the forest (requiring the use of either global
groups or universal groups for the permission assignments.

You can use of of two permission strategies.
1) Create a custom global group in each domain to represent the target users
or target computers for the certificate template. Add both groups (based on
the fact that you state you have a root domain and a child domain), and
assign each group Read and Enroll permissions.
2) Create a custom global group in each domain to represent the target users
or target computers for the certificate template. Add each global group to a
custom universal group and assign the universal group Read and Enroll
permission for the certificate template.

Brian

"JulioHM" <juli...@xxxxxxxxx> wrote in message

news:c608d1e5-9e29-45ef-b721-d981f9b89963@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Hi,

We have a forest setup (all servers are win2003) where we have one
root domain controller (actresses.net) and one child domain
(hot.actresses.net) controller.

Root domain has an Enterprise CA installed, and we are trying to allow
computers in the child domain to request certificates from the root
domain. We keep getting the same error message, no matter what we try.

After following the Certificate Request Wizard in the MMC Certificate
snap-in, the following error message appears.

---------------------------
Certificate Request Wizard
---------------------------
The certificate request failed because of one of the following
conditions:
- The certificate request was submitted to a Certification
Authority (CA) that is not started.
- You do not have the permissions to request certificates from the
available CAs.
---------------------------
OK
---------------------------

Apparently, as we have googled around, this message seems to have
several possible reasons to show up. We've tried changing all kinds of
permissions everywhere (templates, active directory) but without any
luck.

Would anyone have any clue of how work around this?

Any help is apreciated.

Thanks
Julio

.

Relevant Pages

  • Re: Windows 2003 - Child domain cannot request certificate from root domain
    ... replication configuration for the windows network? ... permissions on the certificate template you want to use. ... domain to request certificates from the CA> ...
    (microsoft.public.windows.server.security)
  • Re: Windows 2003 - Child domain cannot request certificate from root domain
    ... replication configuration for the windows network? ... permissions on the certificate template you want to use. ... domain to request certificates from the CA> ...
    (microsoft.public.windows.server.security)
  • Re: Certificate Template
    ... "How to Change the default font in OWA" wrote in message ... However still am not able to see the Certificate Template even after so many ... permissions for the Read, Enroll, and Auto-enroll permissions. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Win2K3 CA, web cert request problem
    ... The user would need to be in a global group that has read and enroll ... permissions for the certificate template. ... The link below supplies more ...
    (microsoft.public.windows.server.security)
  • Re: No Global Address list when trying to send an Email
    ... So It can not be a permissions problem. ... I have just done a new Outlook Profile for the user using Cached mode as ... The Child domain was created about 3 weeks ago, ... Data from the Exchange Server Corp1". ...
    (microsoft.public.exchange.admin)