Solved

Use of certificates across different AD forests

Posted on 2009-07-16
2
2,119 Views
Last Modified: 2012-06-27
Hello,

Our company has just had a merger.  This means that we have 4 AD forests.  Forest1 has an AD integrated certificate server which is used for 802.1x authentication.  The other forests do not have a certificate server.  We are currently in the process for migrating everyone to Forest1, but in the meantime we need everyone is the other forests to be able to use forest1's certificates for authentication.  Would this be possible?  There are trusts between the domains, but we can't seem to get it working.  

Each time we browse to the certificate server to request a new certificate we get the following message:

Certificate Request Denied  

Your certificate request was denied.

Your Request Id is 13024. The disposition message is "Denied by Policy Module 0x8007202b, The requester's Active Directory object is not in the current forest. Cross forest enrollment is not enabled. CN=XXXXX,CN=Users,DC=XXXXX,DC=XXX,DC=XXX ldap: 0xa: 0000202B: RefErr: DSID-031006E0, data 0, 1 access points ref 1: 'XXXXX.XXX.XXX' ".
Contact your administrator for further information.

Is there any way to enable Cross forest enrolment?  From what we have read you need windows 2008 server.  At the moment we only have 2003 server.  We would also like to do this without having to introduce new certificate servers to the domains.

Thanks for any help you can give
0
Comment
Question by:dccdesktop
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 31

Accepted Solution

by:
Paranormastic earned 500 total points
ID: 24870367
Cross forest enrollment is going to be a new CA feature in 2008 R2, whenever that ends up being.  In my opinion, this is probably the biggest advancement in MS cert services since 2003 came out.  SCEP was nice, but this is a much bigger deal.

For now, you would need to create a local account in that domain and then issue the cert, export it including private key, and then install it on the end workstation.  At least one of your CDP locations will need to be accessible from the other workstations (for the root CA and any applicable subordinate CAs), which hopefully isn't too big of a deal.

Unless you are itchy enough to start testing on the beta and roll out a new subordinate CA for this purpose, that's about how it has to be for another year or so.

Here are a couple links about this upcoming feature:

http://blogs.technet.com/pki/

(big download)
http://download.microsoft.com/download/f/2/1/f2146213-4ac0-4c50-b69a-12428ff0b077/Windows_Vista_PKI_Enhancement_in_Windows_7_and_Windows_Server_2008_R2.pptx
0
 

Author Closing Comment

by:dccdesktop
ID: 31604147
Thanks. I had a feeling that 2008 was the only way to do what we wanted.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Last week, our Skyport webinar on “How to secure your Active Directory” (https://www.experts-exchange.com/videos/5810/Webinar-Is-Your-Active-Directory-as-Secure-as-You-Think.html?cid=Gene_Skyport) provided 218 attendees with a step-by-step guide for…
Businesses who process credit card payments have to adhere to PCI Compliance standards. Here’s why that’s important.
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question