Designing and Implementing a PKI: Part III Certificate Templates
First published on TechNet on May 27, 2010 The series: Designing and Implementing a PKI: Part I Design and Planning Designing and Implementing a PKI: Part II Implementation Phases and Certificate Authority Installation Designing and Implementing a PKI: Part III Certificate Templates Designing and Implementing a PKI: Part IV Configuring SSL for Web Enrollment and Enabling Key Archival Designing and Implementing a PKI: Part V Disaster Recovery Chris here again.Certification Authority not showing up in IIS Server Certificates Dialog
Got an Online Certification Auhtority that is not showing up in IIS when you are trying to renew a certificate? If so, this is the post for you. Sit back, grab a cup of coffee and start reading as we go over what you need to do to get your desired Online Certification Authority back in IIS.Designing and Implementing a PKI: Part V Disaster Recovery
First published on TechNet on Apr 07, 2011 The series: Designing and Implementing a PKI: Part I Design and Planning Designing and Implementing a PKI: Part II Implementation Phases and Certificate Authority Installation Designing and Implementing a PKI: Part III Certificate Templates Designing and Implementing a PKI: Part IV Configuring SSL for Web Enrollment and Enabling Key Archival Designing and Implementing a PKI: Part V Disaster Recovery Chris here again.
An error occurred while obtaining certificate enrollment policy.
Recently I was following: KB5005413: Mitigating NTLM Relay Attacks on Active Directory Certificate Services (AD CS) After various changes I got to the point where I could not fully disable NTLM on EnterpriseCA server, because I simply could not login to the MSADCA: Audit NTLM authentication requests within this domain that would be blocked if the security policy Network Security: Restrict NTLM: NTLM authentication in this domain is set to Deny for domain servers or Deny domain accounts to domain servers. But also the changes caused the error while accessing from mmc/certificates An error occurred while obtaining certificate enrollment policy. Url: https://entca.domain.local/ADPolicyProvider_CEP_Kerberos/service.svc/CEP Error: The remote endpoint could not process the request. 0x803d000f (-2143485937 WS_E_ENDPOINT_FAILURE) I can click Continue & everything works fine, but would like to understand why the error Help appreciated SebDesigning and Implementing a PKI: Part IV Configuring SSL for Web Enrollment and Enabling Key Archival
First published on TechNet on Apr 06, 2011 The series: Designing and Implementing a PKI: Part I Design and Planning Designing and Implementing a PKI: Part II Implementation Phases and Certificate Authority Installation Designing and Implementing a PKI: Part III Certificate Templates Designing and Implementing a PKI: Part IV Configuring SSL for Web Enrollment and Enabling Key Archival Designing and Implementing a PKI: Part V Disaster Recovery Chris here again.
BitLocker network unlock issue
Hi, I'm struggling a bit with Bitlocker network unlock deployment in my environment. I'm following this guide: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock#bkmk-installnufeature And I have 2 issues overall. First one is the certificate request to CA. I'm able to request certificate and issue it w/o problems. The issue appears later on - the cert looks like it's selfsigned (certificate on the first screenshot is revoked beacuse I didn't want it to stay there since it didn't work like it should). Certificate on the second screenshot is the cert that's popping up in certmgr.msc on the machine that I was sending the cert request from. It is the same cert - yet it is not? It should end up in Personal container signed by CA but instead it goes to Pending container and it looks like its selfsigned.. Am I missing something? I'll be honest - I do not have an experience with CA. I simply followed the guide. I made a workaround by doing a selfsigned in the next part, so it is not that big of a problem - although I'd like to have a signed cert there. The real problem is - GPO settings. I've tried everything. Updated the .ADMX files in SysVol manually, cleared GPO cache on the client machine, tried setting the GPO's from the guide to the multiple containers, even on the root domain level itself (just for testing puropses) - no luck. The policy simply do not apply. There is no error in RSOP or in gpresult. I've tested it on multiple machines and user accounts with Security filtering and without. I tied to split it to 3 separate policies to check if maybe one of them is problematic. None of these 3 policies applied even once. Other poclies are applied without any problems or issues. What should I do now? Anyone had similar issue?
