Forum Discussion

azuser's avatar
azuser
Tin Contributor
Jan 05, 2025

Certificate based Authentication and KB5014754

Hello community,

 

we have an AD CS that issues certificates to users and computers. How do we achieve automatic certificate mapping?

 

According to KB504754, strong certificate mapping is to be done. Currently, AD computer/user certificates are being used, and no mapping has been configured. Will this continue to work?

Active Directory
security
windows server

1 Reply

  • Jamony's avatar
    Jamony
    MCT
    Sep 17, 2026

    This has become more important since the original question was posted. As of the September 9, 2025 Windows security updates, the temporary compatibility-mode registry workaround is no longer supported.

     

    For certificates issued by Microsoft Enterprise CA templates, the preferred approach is to issue certificates that contain the SID security extension so the DC can strongly map the certificate to the AD object.

     

    Existing certificates that don't meet one of the strong-mapping methods can fail authentication under full enforcement. Check the DC System log for certificate-mapping events and validate your templates before renewing certificates.

     

    If you're using a non-Microsoft CA or certificates where the requester supplies the subject, you may need one of the supported explicit strong mappings instead.