Get-ExchangeCertificate comes back with error

PatrickDoman
PatrickDoman used Ask the Experts™
on
When I run Get-ExchangeCertificate from the Exchange Powershell, I get : Warning: An unexpected error has occurred and debug information is being generated: The process does not possess the 'SeSecurityPrivlege' privlege which is required for the operation.

When I run policytest.exe from the command line, it shows that I do.

It shows my DC server name, it shows the site name and it shows Right Found: "SeSecurityPrivlege"


I am at a loss. Other commands work fine. I ran Get-Mailbox, I ran Get-ExchangeServer and it works.

+ Get-ExchangeCertificate
+ ~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Get-ExchangeCertificate], Pri
   vilegeNotHeldException
    + FullyQualifiedErrorId : System.Security.AccessControl.PrivilegeNotHeldEx
   ception,Microsoft.Exchange.Management.SystemConfigurationTasks.GetExchange
  Certificate


Any ideas?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
IT Services Manager
Commented:
Check to see if you have  KB2506146 and KB2506143 installed on your server. If you have them installed just remove them (http://blogs.technet.com/b/exchange/archive/2012/12/14/windows-management-framework-3-0-on-exchange-2007-and-exchange-2010.aspx)
Stelian StanIT Services Manager

Commented:
Also, are you running PowerShell as Administrator? If not just do that an try again.

Author

Commented:
I am running as admin.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
I see them now. They are both in there.

Author

Commented:
I removed the Framework 3.0 update. Still not working. Rebooting Server, we'll see if that helps.
Stelian StanIT Services Manager

Commented:
sounds good. Done for today. Hope that fixes your problem.

Author

Commented:
That didn't do it, but I think you were on the right path.

Watson report about to be sent to dw20.exe for process id: 7816, with parameters: E12, c-RTL-AMD64, 08.03.0083.006, powershell, M.E.Net, M.E.S.C.X.TlsCertificateInfo.GetAccessRules, S.S.AccessControl.PrivilegeNotHeldException, c8c6, 08.03.0297.000.  ErrorReportingEnabled: False

Author

Commented:
When I type in New-ExchangeCertificate i am getting another error.

New-ExchangeCertificate: Insufficient rights to grant Network Service access to the certificate with thumbprint ..........................

Author

Commented:
I have an account called recovery on the server which I found had the Manage auditing and security log right.

I logged in as that user, and I can run the Get-ExchangeCertificate command.
Tried logging out, adding the administrator account through the Default Domain Policy to the User Rights Assignment \ Manage Auditing and Security Log there

added domain\administrator as well as just administrator

No change, still can't run Get-ExchangeCertificate
This issue is resolved.

By going into the Default Domain Policy on the DC through Group Policy Management, I was able to add the Exchange Servers group to the Local Policies\User Rights Assignment\Manage Auditing and Secrity Log.

That as well as getting the domain admin account in there allowed me to finally run the Get-ExchangeCertificate command. I then found that the SMTP service was assigned to a expired certificate and was able to run the command Enable-ExchangeCertificate -Thumbprint <thumbprintid> -Services SMTP and it assigned the SMTP service to the correct certificate. All I have left to do is to remove the SMTP service from the Internally generated certificate it has been operating under.

I ran the Enable-ExchangeCertificate -thumbprint <thumbprintidtoremove> -services "none" command.

The server certificate or what appears to be the default system certificate shows it still has the smtp service assigned. Perhaps this is by desing. Now I just need to identify how to renew that since it has expired. Not sure if that certificate being expired is causing any other issues.
Stelian StanIT Services Manager
Commented:
OK, that means you have to renew the certificate. To do that have a look on this  document: http://www.sslshopper.com/article-how-to-use-ssl-certificates-with-exchange-2007.html

Author

Commented:
My own troubleshooting allowed for resolution to the issue by putting the Exchange Servers group in the Default Domain Policy so that the Get-ExchangeCertificate command would work. While clonyxlro was able to help me resolve the issue with the knowledgebase article on the updated framework 3.0, my work resolved the issue more evidently as the framework alone was not enough to resolve the issue.
Stelian StanIT Services Manager

Commented:
Glad that is working. Thank you.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial