Manually certificate mapping for Windows device EventID39

Question

Hello;
I am trying to manual map the ADCS issued computer certificate to the "altSecurityIdentities" attribute of computer object in Active Directory. Subject to the information found in "KB5014754—Certificate-based authentication changes on Windows domain controllers". After mapping, I still found that the Event ID 39 warning for some computer object. I verified the serial number of the computer certificate, it is same as what I entered in "altSecurityIdentities" attribute, the only difference is lower case. For sure, the serial number in "altSecurityIdentities" attribute is in reverse order. pls help to give me some information to address this issue. thanks ahead.

Answer 1

Check this link for help - https://community.spiceworks.com/topic/2357868-snap-ad-auth-failures-hp-bios-updates-tech-salaries-google-i-o

Answer 2

Hello there,

Event ID 39 - Source: Kerberos-Key-Distribution-Center

The Key Distribution Center (KDC) encountered a user certificate that was valid but could not be mapped to a user in a secure way (such as via explicit mapping, key trust mapping, or a SID).

New extension will appear only in certificates issued AFTER applying KB article to CA server. Existing certificates remain unchanged. Keep in mind that SID extension is included in certificates that are issued against online templates (where subject is built from AD). Certificates issued against offline templates (where subject is supplied from request) will not contain SID extension, because offline certificates do not map to devices in AD by default. It is unclear whether your certificate was issued against online or offline template.

Similar discussion here

https://learn.microsoft.com/en-us/answers/questions/1226382/manually-map-windows-device-certificate-to-ad-cs-t

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--