Solved

Computer certificates enrolling multiple times

Posted on 2013-06-12
4
772 Views
Last Modified: 2013-07-03
I am having an issue with a 2008 R2 Standard Enterprise CA where computer accounts are being issued multiple certificates. Auto-enrollment is configured via group policy. The template in use is "Copy of Workstation Authentication". "Publish certificate in Active Directory" and "Do not automatically reenroll if a duplicate certificate exists in Active Directory" are both enabled on the template. It is not a widespread issue but there are usually a few a day, but not for the same computer day after day.

It may not be at all related but the event application log for this CA server frequently has the following logged:

Event 77: Classic, CertificationAuthority

The "Windows default" Policy Module logged the following warning: The Active Directory connection to CASERVER.DOMAIN.COM has been reestablished to CASERVER.DOMAIN.COM.

Your assistance is greatly appreciated.
0
Comment
Question by:cberrymd
  • 2
  • 2
4 Comments
 
LVL 18

Expert Comment

by:irweazelwallis
Comment Utility
i have the same issue but i don't have that warning in my event logs
0
 
LVL 18

Expert Comment

by:irweazelwallis
Comment Utility
my problem was that i had the Session Host Server authentication setting enabled and this causes the problem i.e. when a background refresh happens it generates a new certificate
0
 

Accepted Solution

by:
cberrymd earned 0 total points
Comment Utility
Issue resolved by removing "Publish in DS" for workstation/computer/server templates and increasing server resources to improve performance. AD CS probably issued multiple certs due to poor connectivity with revocation information.
0
 

Author Closing Comment

by:cberrymd
Comment Utility
No answers provided. EE community did not assist.
0

Featured Post

Want to promote your upcoming event?

Are you going to an event? Are you going to be exhibiting at a tradeshow? Talking at a conference? Using a promotional banner in your email signature ensures that your organization’s most important contacts stay in the know and can potentially spread the word about the event.

Join & Write a Comment

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through locating and launching the BEUtility application to properly change the service account username and\or password in situation where it may be necessary or where the password has been inadvertently change…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

763 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now