Cross Forest certificate Auto Enrollment Concern

Question

Hi!

Currently we have two forest with child domains: Forest A and Forest B(with child domain C). i have successfully configure cross forest certificate enrollment. CA is on Forest A and we will be deploying workstation certificates to domain C and on the parent domain in forest B. i have encountered two issues:

1. Some computers have failed request: "Denied by Policy Module 0x8007202b, The requester's Active Directory object is not in the current forest. Cross forest enrollment is not enabled"
2. When using certutil -ping -config "<FQDN of domain>\<CA name>" i get RPC server unavailable. but when i try to ping the server or check ports using portqry tool for tcp 135 it push through the server

is there anything wrong with my setup? i have been stuck troubleshooting for awhile now.

Answer 1

Hi!

I am monitoring the behavior of the deployment of certificates from the CA and i have not seen the cross forest is not enabled from the failed request until now.
For the RPC error. I just found out that the workstation that have this error cannot reach its parent domain in Forest B we allow it first then test manual enrollment via mmc and it has successfully enrolled the certificate.

additional I also added domain computers group from forest B and its child domain and domain controllers group to the certificate services DCOM access in Forest A. I don't know if this also has an impact to fix the issue. But its worth a try.

Until now Cross forest enrollment is okay. and will still monitor and update this thread if something unusual comes up.

Thanks for all your help!
@Vadims Podāns @Daisy Zhou @Thameur-BOURBITA

Answer 2

Hi,

Check if Allow authentication permission is well configured on each forest.

You can read this link to get more details:

ff955845(v=ws.10)

please don't forget to mark this reply as answer if it help you to fix your issue