Jakeberm

Revocation checking fails when CDP/AIA locations in the CA's cert can't be reached

jakeberm — Fri, 28 Dec 2007 15:04:00 GMT

Error:

A Certificate request fails with: "The certification authority denied the request. The revocation function was
unable to check the revocation because the revocation server was offline."

OR:

Certificate services just fails to start with similar errors as in KB 825061. It’s a similar revocation error deep down, though.

Workaround:

To temporarily work around the issue in Windows 2000, use the method described in KB 825061. To work around it in 2003, set the CRLFLags value to basically tell it to ignore revocation errors:

certutil –setreg ca\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE

Restart certificate services in both cases, and it should now start and/or also issue certs once more. But this is a temporary fix if you’re dealing with a subordinate CA (read below).

What does the error mean? How do we fix it?

This error is usually going to indicate that the CDP locations listed in the CA’s certificate can’t be reached. How to verify this:

Certutil –verify –urlfetch .cer

Certutil –url .cer

This is going to show the same revocation error perhaps for one or more CRL locations. We need to then determine if the CRL location (https://, ldap:///, file://) is actually pointing to a bad server (that doesn’t exist and will never exist) or to a valid server… that just doesn’t have the CRL properly installed/copied. If the CRL is just not there, copy it to that location (http/file) or use certutil –dspublish to import it to the AD.

If the CRL location is permanently bad…

- Is this a root CA?

o In theory, the Root CA’s cert should have empty CDP and AIA paths (good design), as it would never need to check those CDP/AIA paths for any revocation functions. To keep things simple, you should be able to run the certutil command to just disable offline revocation failures.

- Is this a subordinate CA?

o If so, you would need to renew the CA’s cert, this time with good CDP/AIA locations. Where does the subordinate cert get its CDP/AIA locations from? From the extension settings of the root CA (not the CAPolicy.inf J). Go to the root CA certification authority snapin, right click on the name of the CA, go to properties, to the Extensions tab, and set up proper CDP and AIA paths that the subordinate CA(s) can access. Then, re-request the subordinate CA’s cert with the SAME key pair, install it (certutil –installcert), and you should be good to go.

What you will see in a netlogon debug log (on client and DC) during a successful secure channel password reset

jakeberm — Wed, 31 Jan 2007 18:29:00 GMT

Here are the details you will see in the netlogon debug log on the client and the DC for a SUCCESSFUL secure channel reset:

Note: Running "netdom reset /domain: /server: /usero:\administrator /passwordo:*" instead of ntltest renders the exact same debug information - basically the same action is being taken.

= FQDN

= netbios domain name

= netbios name of client

= IP of the DC

= DC's netbios name

- Windows XP SP2 netlogon debug log entries while running "nltest /sc_reset:\”:

01/31 13:56:53 [SESSION] NETLOGON_CONTROL_REDISCOVER function received.

01/31 13:56:53 [MAILSLOT] NetpDcPingListIp: .: Sent UDP ping to

01/31 13:56:53 [MISC] NlPingDcNameWithContext: Sent 1/1 ldap pings to

01/31 13:56:53 [MAILSLOT] NlPingDcNameWithContext: Sent 'Sam Logon' message to [00] on (null).

-> (The above 4 lines are Netlogon running a rediscovery/ping of the DC. I omitted this from the 2000 debug log below)

01/31 13:56:53 [MISC] NlPingDcNameWithContext: responded over IP.

01/31 13:56:53 [MISC] : NlPingDcName: : .: Caching pinged DC info for

01/31 13:56:53 [SESSION] : NetrLogonControl: Successful response from DC

01/31 13:56:53 [SESSION] : NlSetStatusClientSession: Set connection status to c000005e

01/31 13:56:53 [SESSION] : NlSessionSetup: Try Session setup

01/31 13:56:53 [SESSION] : NlSetStatusClientSession: Set connection status to 0

01/31 13:56:53 [DOMAIN] Setting LSA NetbiosDomain: DnsDomain: . DnsTree: . DomainGuid:7ec5ada6-a412-4b9f-9c40-21079e438d6f

01/31 13:56:53 [LOGON] NlSetForestTrustList: New trusted domain list:

01/31 13:56:53 [LOGON] 0: (NT 5) (Forest Tree Root) (Primary Domain) (Native)

01/31 13:56:53 [LOGON] Dom Guid: 7ec5ada6-a412-4b9f-9c40-21079e438d6f

01/31 13:56:53 [LOGON] Dom Sid: S-1-5-21-1444530721-2061370028-146505126

01/31 13:56:53 [SESSION] : NlSetStatusClientSession: Set connection status to 0

01/31 13:56:53 [SESSION] : NlSessionSetup: Session setup Succeeded

Windows 2000 SP4 netlogon debug log entries while running "nltest /sc_reset:\":

01/31 14:23:52 [MISC] NlPingDcNameWithContext: responded over IP.

01/31 14:23:52 [MISC] : NlPingDcName: : .: Caching pinged DC info for

01/31 14:23:52 [SESSION] : NetrLogonControl: Successful response from DC

01/31 14:23:52 [SESSION] : NlSetStatusClientSession: Set connection status to c000005e

01/31 14:23:52 [SESSION] : NlSessionSetup: Try Session setup

01/31 14:23:52 [SESSION] : NlSetStatusClientSession: Set connection status to 0

01/31 14:23:52 [DOMAIN] Setting LSA NetbiosDomain: DnsDomain: . DnsTree: . DomainGuid:7ec5ada6-a412-4b9f-9c40-21079e438d6f

01/31 14:23:52 [LOGON] NlSetForestTrustList: New trusted domain list:

01/31 14:23:52 [LOGON] 0: (NT 5) (Forest Tree Root) (Primary Domain) (Native)

01/31 14:23:52 [LOGON] Dom Guid: 7ec5ada6-a412-4b9f-9c40-21079e438d6f

01/31 14:23:52 [LOGON] Dom Sid: S-1-5-21-1444530721-2061370028-146505126

01/31 14:23:52 [SESSION] : NlSetStatusClientSession: Set connection status to 0

01/31 14:23:52 [SESSION] : NlSessionSetup: Session setup Succeeded

XP's reset logged in the Windows 2003 DC's Netlogon log:

01/31 13:56:53 [MAILSLOT] Received ping from . $ on UDP LDAP

01/31 13:56:53 NO_CLIENT_SITE:

01/31 13:56:53 [MAILSLOT] Ping response 'Sam Logon Response Ex' $ to \\ Site: (null) on UDP LDAP

01/31 13:56:53 [MAILSLOT] : Received 'Sam Logon' message on \Device\NetBT_Tcpip_{25A3660A-55D7-4A50-AD1F-CC1A465CA4D3}

01/31 13:56:53 NO_CLIENT_SITE:

01/31 13:56:53 [MAILSLOT] Ping response 'Sam Logon Response Ex' $ to \\ Site: (null) on \Device\NetBT_Tcpip_{25A3660A-55D7-4A50-AD1F-CC1A465CA4D3}

01/31 13:56:53 [SESSION] NetrServerAuthenticate entered: on account $ (Negot: 600fffff)

01/31 13:56:53 [SESSION] NetrServerAuthenticate returns Success: on account $ (Negot: 600fffff)

01/31 13:56:53 [SESSION] NetrLogonGetDomainInfo: 1 Entered

01/31 13:56:53 [SESSION] NetrLogonGetDomainInfo: is running NT 5.1 build 2600 (1)

01/31 13:56:53 [MISC] NetrLogonGetDomainInfo: DnsHostName of is .

01/31 13:56:53 [SESSION] NetrLogonGetDomainInfo: 1 Returns 0x0

2000's reset logged in the Windows 2003 DC's Netlogon log:

01/31 14:23:52 [MAILSLOT] : Received 'Sam Logon' message on \Device\NetBT_Tcpip_{25A3660A-55D7-4A50-AD1F-CC1A465CA4D3}

01/31 14:23:52 NO_CLIENT_SITE:

01/31 14:23:52 [MAILSLOT] Ping response 'Sam Logon Response Ex' $ to \\ Site: (null) on \Device\NetBT_Tcpip_{25A3660A-55D7-4A50-AD1F-CC1A465CA4D3}

01/31 14:23:52 [SESSION] NetrServerAuthenticate entered: on account $ (Negot: 6007ffff)

01/31 14:23:52 [SESSION] NetrServerAuthenticate returns Success: on account $ (Negot: 6007ffff)

01/31 14:23:52 [SESSION] NetrLogonGetDomainInfo: 1 Entered

01/31 14:23:52 [SESSION] NetrLogonGetDomainInfo: is running NT 5.0 build 2195 (1)

01/31 14:23:52 [MISC] NetrLogonGetDomainInfo: DnsHostName of is .

01/31 14:23:52 [SESSION] NetrLogonGetDomainInfo: 1 Returns 0x0

How to change the password of every user in a container (or domain) to a default, and require them to change their password at next logon

jakeberm — Mon, 29 Jan 2007 19:10:00 GMT

This method utilizes a tool called dsmod.exe, built in to Windows Server 2003, to modify the user's password, set the User must change password at next logon flag, and the Password Never Expires flag to null (if Pwd Never Expires is set, running just a "-mustchpwd yes" would fail).

On a Windows 2003 DC:

1. Dump all of the users from a specific OU, domain, or container to create a bulk list of users (for whom we want to change the password), listed by distinguished name (DN):

Ldifde –d ou=OUname,DC=domain,DC=com –r (objectclass=user) –l DN –f c:\users.txt

Note: Change "DC=domain,DC=com" to your domain name, or the container in your domain in which the users exist.

2. Open users.txt in notepad in order to remove two superfluous repetitive pieces of information we don’t need in the file. This will leave us with just DNs (don’t worry, empty lines can be left, they will not matter)

a. Edit menu -> Replace ALL

b. Replace “dn: “ with nothing

c. Replace “changetype: add” with nothing

d. This leaves us with a file that has a user’s DN on one line, then two lines of blank space, then another user’s DN, and so on. This is our “answer” file for the next step.

3. We now run a for loop, which will set the password for every user to (enter a password here, remembering to satisfy password policy complexity requirements) and set their account to be required to change the password at net logon:

a. For /f “eol= tokens=1 delims=” %i in (c:\users.txt) do dsmod user “%i” –pwd -mustchpwd yes –pwdneverexpires no

b. Type it exactly as written above, including spaces. Make sure that the password meets complexity requirements. The for loop will run through every user in the users.txt file, changing their password, setting the Password Never Expires flag to null (in order to be able to set the User Must Change Password at Next Logon flag) and then sets the flag to have the user change password at next logon.

Maximum number of RIDs available in a Windows domain?

jakeberm — Wed, 03 Jan 2007 17:22:00 GMT

The maximum number of RIDs available in a 32-bit-OS-hosted domain (NT4/2000/2003) is 1073741824

The RID space is 30-bits, therefore 2^30 = 1073741824

You can lower the maximum number of RIDs via registry values, referenced in the article below:

    HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\RID Values

    "Minimum RID"
    "Maximum RID"

Other references:

https://www.microsoft.com/technet/prodtechnol/comm/comm2002/maintain/perform/sadcs/ad02d.mspx

How to query on a specific attribute (like EmployeeID) and then set other attributes from an answer file

jakeberm — Tue, 29 Aug 2006 20:34:00 GMT

Ldifde and Csvde are great for finding an obect by it's DN, and then adding/modifying/removing attributes on said object. But, what if you want to do the same task, except using a different attribute to find the object in question? By using ADModify and the cmd line tool included with ADModify (admodcmd.exe) we can do just this.

In this example, we will:

- Perform an LDP query for an attribute (in this case, employeeID)

- The specific value we query for employeeID is taken from the first value on each line inside an answer/input/csv file, which is prepopulated with attributes.

- Once the object with the correct employeeID attribute is found, we then set the respective x other attributes for that object

- The for loop then continues, processing each line of the csv file until all entries are processed

The command is a for loop which calls admodcmd. In this example, we are querying on Employee ID, and then setting 3 other attributes: Company, Department, and Title:

For /f “eol=; tokens=1,2,3,4 delims=, “ %%i in (input.txt) do admodcmd –dn dc=yourdomain,dc=com –p 1000 –s –server -f (employeeID=%%i ) –custom company %%j –custom department %%k –custom title %%l

We’re basically telling the for loop to read 4 variables/tokens out of the input.txt file (filename can be anything), and then it passes these 4 values as %%i, %%j, %%k, and %%l - %%i will be the employeeID attribute, which we tell admodcmd to do an LDAP search for. We may need to search the entire domain for the user with said employeeID, but if you know that the target users are all in a specific OU, change the DN you search for the sake of efficiency.

Once admodcmd finds the user with that employeeID, it sets company, department, and title using the –custom switches. Then, it goes to the next line in input.txt and starts again for the next employeeID/object.

In this example the formatting inside the input file was:

123456789,Microsoft,ProductSupport,TechLead

987654321,Microsoft,ProductSupport,SupportEngineer

You may need to change the eol or delims section of the for command if your formatting is different inside your input/answer file. The example file represents what a normal csv file would look like.

NOTES:

======

Download ADModify from:

https://www.gotdotnet.com/workspaces/workspace.aspx?id=f5cbbfa9-e46b-4a7a-8ed8-3e44523f32ed Download link is that the bottom right of the page, under the "Releases" section.

How to Rar/Zip archive multiple folders into separate files using winrar

jakeberm — Fri, 30 Dec 2005 17:58:00 GMT

Here's the problem: I have a folder which contains hundreds of subfolders, and I wanted to make each subfolder into it's own ZIP file of the same name. Winrar doesn't have the built-in functionality to accomplish this goal, or none that I could find (feel free to correct me). And I'm not a fan of winzip or any other archival utilities, so I set out to get this accomplished via winrar.exe's command line interface.

I wrote a simple for loop to get the job done:

for /F "eol= delims=" %%A IN (dir.txt) do winrar A -ep1 -r %%A.zip "y:\"%%A"\*.*"

Dir.txt is an ouput of a dir command listing all of the subdirectories. Use the following command to generate it without any superfluous information:

dir /A:D /B >dir.txt

The for loop command breakdown (from above) is:

for /F IN do

The command in this example is winrar A -ep1 -r . You can see that I was referencing files from a mapped drive, your siutation might be different.

A = add files to archive

-ep1 = do not add the base folder to the archive, instead add only the files inside that base subdirectory

-r = recurse subdirectory

Winrar.exe has quite a few othe switches that you can play around with, but this is just a sample of how to get the command working for what I wanted to accomplish.

Random questions on how to search for deleted objects in the Active Directory

jakeberm — Wed, 30 Nov 2005 21:05:00 GMT

This is by no means a complete guide to the viewing and deletion of objects in the "CN=Deleted Objects,DC=domain,DC=com" container, but I have answered a few questions and provided some guidance here. I will update it if I have time. In answering these questions, I set up a repro in which I programmatically created 10000 dummy users in an OU, and then deleted the users thereafter to generate a ton of deleted objects.

The customer has questions related to the section "How to manually undelete objects in a deleted object's container" from:

840001 How to restore deleted user accounts and their group memberships in
https://support.microsoft.com/?id=840001

Customer's main questions (and answers inline):
=====================================

1. "If the object I want to undelete is displayed in the left pane, the process does work. HOWEVER, if the object I want to undelete is not displayed, how do I scroll the left pane down to reach my object?"

Modifying the MaxPageSize value with ntdsutil will allow you to increase the number of objects displayed in a tree view in LDP. I repro'ed this, and found that once the value is elevated, more results are displayed. In my case, I set MaxPageSize to 10000. The "cost" of the LDAP query (returning more objects) will simply result in a slower response, but a complete response.

2. "Can I filter the output in the left pane to say only deleted "computer" objects, or "user" objects?"
3. "Why does the Browse > Search > Page option only seem to work on the right pane, not the left pane?"

Answering these both together: There is no way to filter the results of the tree view pane on the left. This is essentially due to the way ldp.exe was designed. You can, though, perform filtered searches which output in the right column (which I think you have been trying). In a case where you specifically want to query for only user or computer objects, the "or" filter for this would be:

(|(objectclass=user)(objectclass=computer))

Use the following doc as a reference on building search filters:

255602 XADM: Browsing and Querying Using the LDP Utility
https://support.microsoft.com/?id=255602

NOTE: unless you set the page value in the search options high, you would need to continually hit run to see more results. Probably not what you want to do. Plus, if you set the page value too high, like I did in setting it to 10000, it may cause ldp to seem to hang indefinitely while search results are generated. It will eventually return results, though.

ALTERNATE SEARCH METHOD:

Ldifde is a command line tool to modify the AD. It will export objects and import objects, and is a default tool in the OS. I constructed the following command below to query for user objects in the deleted users container. By using the -l switch, I limited the amount of information per object that is returned; specifically just the DN, like the tree view in ldp. This would at least generate a quick list of all user objects in the deleted objects container in the form of a text file. As of now, I cannot seem to get and'ing or or'ing to work with the filter switch, but you could do a separate ldifde search for computers.

ldiifde -f output.txt -s -d "cn=deleted objects,dc=domain,dc=com" -r (objectclass=user) -p subtree -x -l DN

4. What is the lifespan of objects in the Deleted Objects container? How long are they kept for? 120 days?

When we delete an object from the AD, it is moved to the deleted objects container and stays there for the default tombstone lifetime of 60 days. At the 60 day mark, it is garbage collected and permanently deleted out of the directory. The Tombstone lifetime can be increased manually by editing the tombstoneLifetime attribute for the enterprise-wide DS config object. The path for this attribute is:

CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,DC=COMPANY,DC=COM
Use Adsiedit or LDP to set the tombstoneLifetime attribute to a specific number of days.

Reference:

216993 Useful shelf life of a system-state backup of Active Directory
https://support.microsoft.com/?id=216993

5. Can I search by a date range to show me deleted objects for the past 7 days?

To be able to do this, we'd need an attribute on the deleted object to essentially tell us when it was deleted, and the best option is whenChanged. It should be timestamped as of the time the object was deleted. How to utilize it in a productive manner, though?

- We can't neccesarily search exactly on "anything less than 7 days". We could, though, search for items that have a whenChanged attribute value of a certain date or higher.
- A standard whenchanged value looks like this : 20051201001517.0Z (the .0Z is irrelavant in our work here, remove it when searching)
- It is kept in GMT
- Broken down, 20051201001517 equals 2005(year) 12(month) 01(day) 00(hour) 15(minutes) 17(seconds)

So if I wanted to find any objects that were deleted in the last 7 days as of 6PM PST today (Nov 30, 2005), I would use a whenChanged value for Nov 23rd, 6PM PST (20051124020000) in a search filter in ldp like this:

(&(|(objectclass=user)(objectclass=computer))(whenchanged>=20051124020000))

I used greater-than-or-equal-to Nov 23rd at 6PM, which will give me all objects deleted between that date and the present time.

NOTE: This search works in LDP to output data in the right pane. BUT, I cannot seem to get ldifde to recognize the filter yet using and/or. I will research this further.

I don't blog much...

jakeberm — Mon, 04 Apr 2005 14:22:00 GMT

I will use this forum sparingly in the future, less I find some useful purpose for it. Look forward to nothing, you blogaholics.