Re: Microsoft PKI Problem with Domain Controllers (Autoenrollment)
- From: "Steve Foster [SBS MVP]" <steve.foster@xxxxxxxxxxxxx>
- Date: Tue, 14 Aug 2007 06:17:42 -0700
Grovnasch wrote:
Hello everybody,
I have the following problem on my AD-Domain (3 Domain Controllers
with MS-PKI):
all the domain controllers have recurrent errors in the Application
Event Viewer that say:
"Automatic Certificate Enrollment for local system could not find a
valid certificate templete to match DomainControlleras specified in
the group policy automatic enrollment object. Enrollment will not be
performed."
The "DomainController" template is the standard template, which I have
removed from the "Certificta templates to issue" container. Besides, I
have created a new personnalized DomainController template, called
MyDomainController, which is accepted by all the CDs, i.e. all the 3
of them have been issued a valid certificate. Nevertheless, all domain
controllers still ask for a "DomainController" Certificate, although
there is no entry at all in the Default Domain Controller Policy (-->
Computer Settings --> Windows Settings --> Security Settings -->
Public Key Policies --> Automatic Certificate Request Settings).
If I try to reintegrate the "DomainController" template on the CA to --
Certificate Authority --> My CA --> Certificate Templates: New CertTemplate to issue, I get the following error: "The template
information on the CA cannot be modified at this time. This is most
likely because the CA service is not running or these are replication
delays. One or more certificate templates to be enables on this
certificate authority could not be found. The changes can be saved to
Active Directory and retrieved by the CA next time it is started. Do
you want to save the changes to Active Directory?".
Clicking "Yes" and restarting the CA does not solve the problem...
Did anyone have the same problem? Any ides?
This is well beyond the scope of 99% of SBS deployments, and you're unlikely to get a good answer here.
I'd suggest trying one of these groups:
microsoft.public.windows.server.active_directory
microsoft.public.windows.server.security
microsoft.public.security
--
Steve Foster [SBS MVP]
---------------------------------------
MVPs do not work for Microsoft. Please reply only to the newsgroups.
.
- References:
- Microsoft PKI Problem with Domain Controllers (Autoenrollment)
- From: Grovnasch
- Microsoft PKI Problem with Domain Controllers (Autoenrollment)
- Prev by Date: Modem Driver
- Next by Date: Re: Northeast Atlanta user group meeting Thursday August 16, 6:30 pm
- Previous by thread: Microsoft PKI Problem with Domain Controllers (Autoenrollment)
- Next by thread: Wizards not working in SBS2003
- Index(es):
Relevant Pages
|
