Recently, I got a chance to work on one of the case where we couldn’t request the certificate using a template which is configured to archive private keys and getting the following error message “Cannot archive private key. The certification authority is not configured for key archival. Error archiving Private Key. Cannot archive private key. The certification authority is not configured for key archival. 0x8009400a (-2146877430) on Windows Vista:

Picture 1: Vista OS, Error message while requesting certificate.

Picture 2: Windows 2003, Error message while requesting certificate.

In order to be able to request certificate based on a template which allows Private Key to be archived, you have to ensure that your CA is configure for Key Archival.

Picture 4: Certificate Template with Private Key archival enabled.

You should check the CA is configured for Key archival and has a valid certificate. In my case, key archival was enabled but still we were facing the issue.

Picture 5: The CA asks your restart the CA service after enabling Recovery agent.

When you enable KRA, it asks you to restart the CA service and if you don’t do so the KRA certificate will not be loaded and status column for the certificate would say “NOT LOADED”

Picture 6: The KRA certificate status showing Not loaded.

The solution was to restart the CA service and after that KRA certificate status changed to Valid. Once we restarted the CA service we could request the certificate.

Picture 7: After Restarting the CA service the KRA certificate status showing Valid.

There are different commands available to manipulate AD objects.

1. Get-ADGroup: Returns one or more Active Directory Groups.
2. New-ADGroup: Creates an active directory group.
3. Remove-ADGroup: Removes an active directory group.
4. Set-ADGroup: It modifies an Active directory group.

Today, I’m going to talk about these commands. I’ll list out the commands to accomplish most common Group management tasks.

1. Example of Get-ADGroup Command:

• How to get list of security groups but not Distribution group?

Get-ADGroup –Filter ‘GroupCategory –eq “Security”’

• How to get list of Distribution groups but not Security group?

Get-ADGroup –Filter ‘GroupCategory –eq “Distribution”’

• List out all DomainLocal Groups in the domain.

Get-ADGroup –Filter ‘GroupScope –eq “DomainLocal”’

• List out all Global Groups in the domain.

Get-ADGroup –Filter ‘GroupScope –eq “Global”’

• List out Universal Groups

Get-ADGroup –Filter ‘GroupScope –eq “Universal”’

You can also use wildcard character to search for groups. Following command lists out all the group containing word “admin”

Get-ADGroup –Filter ‘Name –like “*admin*”’

We can also combine conditions. For example we want to list out all the Universal groups containing “admin” word.

Get-ADGroup –Filter ‘Name –like “*admin*” –and GroupScope –eq “Universal”’

You can use following operators in Active directory PowerShell.

2. Example of New-ADGroup Command:

The following command creates a Domain Local Security Group named “Helpdesk Admins” under Users container.

New-ADGroup –Name “HelpDesk Admins” –SamAccountName HelpDeskAdmins –GroupCategory Security –GroupScope DomainLocal –DisplayName “HelpDesk Admins” –Path “CN=Users,DC=W2k8Microsoft,DC=local”

3. Example of Remove-ADGroup Command:

The following command removes the group created in 2nd step.

Remove-ADGroup HelpDeskAdmins

You can also remove groups based on Wildcard Character. For example, you want to delete all the groups ending with “admins”

Get-ADGroup –Filter ‘Name –like “*admins”’ | Remove-ADGroup

The above command combines 2 commands with help of “|” sign. Pipe sign redirects the output of Get-ADGroup command as input to Remove-ADGroup command.

4. Example of Set-ADGroup Command:

The following command will convert the helpdeskadmins domain local group to Universal group. We have created this group in Step 2.

Set-ADGroup HelpDeskAdmins –GroupScope Universal

The following command populates the Description field of HelpDeskAdmin Group.

Set-ADGroup HelpDeskAdmins –Description “This is Help Desk Administrator Group”

You can also combine the multiple commands with help of |. For example, if we want to convert all domainLocal Groups ending with admins to universal group.

Get-ADGroup –Filter ‘Name –like “*admins” –and GroupScope –eq “DomainLocal”’ | Set-ADGroup –GroupScope Universal

I hope this post is informative. In next post I’ll discuss more about Active Directory PowerShell commands.

While trying to install Enterprise CA on Windows 2008 machine you receive an error message: “Installation Succeeded with Errors”.

Symptoms:

In the Event log you see the following Events:

Log Name: Application
Source: Microsoft-Windows-CertificationAuthority
Date: 4/20/2009 11:06:09 AM
Event ID: 5
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: dc1.w2k8microsoft.local
Description:
Active Directory Certificate Services could not find required registry information. The Active Directory Certificate Services may need to be reinstalled.

Log Name: System
Source: Service Control Manager
Date: 4/20/2009 11:50:57 AM
Event ID: 7023
Task Category: None
Level: Error
Keywords: Classic
User: N/A
Computer: dc1.w2k8microsoft.local
Description:
The Active Directory Certificate Services service terminated with the following error:

Cannot complete this function.

Additionaly when you try to start the certificate service, you receive error message: “Cannot complete this function 0x3eb(win32:1003)”

Resolution:

Check the permission on "CN=Public Key Service,CN=Services,CN=Configuration,DC=Domain,DC=Com", make sure that Enterprise admin and domain admin have full control.

Open Adsiedit.msc and navigate to CN=Public Key Service and check the permission for Domain admins and Enterprise Admins.

Once you have fixed the permission issue the problem will go away and you can reinstall the CA service.

Source: DFSR     Event ID: 1202

Source: DFSR     Event ID: 4612

Source: DFSR     Event ID: 5008

Source: DFSR     Event ID: 4614

If we have issues with Name resolution then this issue can happen. Please make sure to resolve name resolution problem.

Even after correcting the name resolution problem you should check following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DFSR\Parameters\SysVols\Seeding SysVols\domain.com

"Parent Computer"="DC1.domain.com"

This registry key controls the DC from which Sysvol has to be seeded. Please make sure that we have right entry for this key and pointing to a valid DC.

For more information refer following KB:

https://support.microsoft.com/default.aspx/kb/967336

However, the actual trustType property of the object specifies a type for each trust.

· Value 1: Downlevel trust. This trust is with a Windows NT domain (being external).

· Value 2: Uplevel (Windows 2000 or later) trust. This trust is with an Active Directory domain (being parent-child, root domain, shortcut, external, or forest).

· Value 3: MIT. This trust is with a (non-Windows) MIT Kerberos version 5 realm.

· Value 4: DCE. This trust is with a DCE realm. DCE refers to Open Group's Distributed Computing Environment specification. This trust type is mainly theoretical.

The other meaningful properties of trustedDomain objects are the following:

· trustPartner: For Active Directory domains, this is the DNS name of the partner domain. For Windows NT trusted domains, this is the NetBIOS name of the partner domain. For non-Windows trusted domains, this is the name of the partner Kerberos realm.

· flatName: For Windows trusted domains, this is the NetBIOS name of the partner domain. For non-Windows trusted domains, this is the name of the partner domain or it is NULL.

· trustDirection: 0 = disabled, 1 = incoming (i.e., trusting domain), 2 = outgoing (i.e., trusted domain), 3 = both directions.

· trustAttributes: (hexadecimal values in AD2003) 1 = the trust is nontransitive; 2 = the trust is valid only for Windows 2000 (and newer) computers; 4 = the domain is quarantined (that is, SID filtering is enabled); 8 = the trust is a forest trust; 10 = the trust is a cross-organization trust (that is, selective authentication is being used); 20 = the trust is internal to the forest; 40 = the trust is a forest trust where EnableSIDHistory is on (see the corresponding NetDom option in Help and Support).

· trustAttributes: (hexadecimal values in AD2000) 1 = the trust is nontransitive; 2 = the trust is valid only for Windows 2000 (and newer) computers; 40 0000 = the trust is to the parent domain; 80 0000 = the trust is to another tree root domain in the forest.

Problem:

Couldn’t duplicate Certificate template on Windows 2003 Enterprise Edition Member server CA.

Troubleshooting:

We made sure that all requirements for Certificate Template Duplication are full filled, including followings:

1. The active directory schema was upgraded to W2k3 using ADPREP.

2. The CA, was Enterprise Root CA.

3. The member server was running Windows 2003 Enterprise edition.

4. We were logged in as Domain Admin and enterprise admin.

The enterprise admin and domain admin should have full control on the following objects in AD;

· Full control permissions over the CN=Certificate Templates, CN=Public Key Services,CN=Services,CN=Configuration, DC=ForestRootDomain" container

· Full control permissions over the CN=OID,CN=Public Key Services,CN=Services,CN=Configuration, DC=ForestRootDomain container

· Full Control permissions for each certificate template object in the CN=Certificate Templates, CN=Public Key Services,CN=Services,CN=Configuration, DC=ForestRootDomain" container

When we looked at adsiedit we found that CN=OID was missing.

We did auth restore of CN=OID,CN=Public Key Services,CN=Services,CN=Configuration, DC=ForestRootDomain container using NTDSUTIL. In my case customer didn’t had System State data backup, so we manually created it.

Explanation:

The Windows Server 2003 family adds some additional object identifier containers (also known as OID) to the configuration container. Because object identifiers are not hardcoded in version 2 (V2) templates, object identifier containers are required to work with V2 templates. Only clients running Windows XP and later may resolve object identifiers in Active Directory to friendly names.

CN=OID,CN=Public Key Services,CN=Services,CN=Configuration,DC=

Reference:

1. Certificate Template Overview.

https://technet.microsoft.com/en-us/library/cc787721.aspx

2. KB 949664  Error message when you try to duplicate a certificate template in the certificate template store: "The Computer certificate template could not be duplicated The system cannot find the file specified"

https://support.microsoft.com/default.aspx?scid=kb;EN-US;949664

3. 287547  Object IDs associated with Microsoft cryptography

https://support.microsoft.com/default.aspx?scid=kb;EN-US;287547

4. Appendix A: Directory Objects.

https://technet.microsoft.com/en-us/library/cc786765.aspx]]> https://docs.microsoft.com/archive/blogs/niraj_kumar/script-to-list-out-ous-and-objects-within-it Thu, 12 Feb 2009 02:46:14 GMT https://blogs.technet.microsoft.com/niraj_kumar/2009/02/12/script-to-list-out-ous-and-objects-within-it/ I thought of sharing a script, which will list out a report for all the OU’s in domain. This report is very handy if you want to find out how many objects are part of each OUs. This script generates the report.

In the following code, replace the name of your domain at the place of striked out character in Distinguished name format.

CODE:

On Error Resume Next

Const ADS_SCOPE_SUBTREE = 2
Dim I
Set objConnection = CreateObject("ADODB.Connection")
Set objCommand =   CreateObject("ADODB.Command")
objConnection.Provider = "ADsDSOObject"
objConnection.Open "Active Directory Provider"
Set objCommand.ActiveConnection = objConnection

objCommand.Properties("Page Size") = 1000
objCommand.Properties("Searchscope") = ADS_SCOPE_SUBTREE

objCommand.CommandText = _
    "SELECT ADsPath FROM 'LDAP://dc=2003dom,dc=local' WHERE " & _
        "objectCategory='organizationalUnit'" 

Set objRecordSet = objCommand.Execute

objRecordSet.MoveFirst

Do Until objRecordSet.EOF
    Set objOU = GetObject(objRecordSet.Fields("ADsPath").Value)
        I=0
    Wscript.Echo objOU.distinguishedName
    For Each objItem in objOU
        I=I+1
    Wscript.Echo "       ",objItem.distinguishedName
    Next
    Wscript.Echo "Total Objects in this OU:",I
    objRecordSet.MoveNext
Loop

The output will be something like this:

1. To set the administrative password

· At a command prompt, type the following: net user administrator *

· When prompted to enter the password, type the new password for the administrator user account and press ENTER.

· When prompted, retype the password and press ENTER.

2. To rename the server

· Determine the current name of the server with the hostname or ipconfig command.

· At a command prompt, type: Netdom renamecomputer <ComputerName> /NewName:<NewComputerName>

· Restart the computer.

3. Enabling Automatic Updates

To enable automatic updates on the server we will use another built-in script method scregedit.wsf. Here are the options:

3.1 To verify the current setting, type: Cscript scregedit.wsf /AU /v

3.2 To enable automatic updates, type: Cscript scregedit.wsf /AU 4

3.3 To disable automatic updates, type: Cscript scregedit.wsf /AU 1

4. To Set Date ,Time and Time Zone

Type control timedate.cpl on the command prompt which will open the same Date and Time applet that can be open from control panel in the full installation of Windows Server 2008.

]]> https://docs.microsoft.com/archive/blogs/niraj_kumar/how-to-request-certificate-from-third-party-ca-and-install-it-on-the-machine Tue, 10 Feb 2009 19:26:28 GMT https://blogs.technet.microsoft.com/niraj_kumar/2009/02/10/how-to-request-certificate-from-third-party-ca-and-install-it-on-the-machine/ The right way to go about requesting and installing certificate are below:

1. Run certreq –new request.inf request.req

2. Send request.req file to third part CA.

3. Retrieve the certificate blob and save it in certnew.cer. Please make sure that you save the file in the same directory where you have saved request.req file.

4. Accept the issued certificate: Certreq –accept certnew.cer.

5. Once you install the certificate, restart the machine ( if it is computer certificate.)

As explained earlier, .cer file only contains public key. It is certreq –accept certnew.cer command which associates private key with that certificate and installs it in correct store.

Creating Certificate Requests

The –new parameter with certreq.exe is used to construct new certificate requests. Certreq.exe uses an INF file as an input option that defines the certificate request parameters. When the certificate request is constructed based on the INF file, key material is also generated. A certificate request process can be divided into the following elements.

1. Read the INF file.

2. Create the private and public key based on the information in the INF file, and store the private key in the local key store of the user or machine profile as appropriate.

3. Create the certificate request based on the information in the INF file and store the request in a Base64-encoded file or, optionally, in binary form if the –binary option is selected.

MachineKeySet

This key is important when you need to create certificates that are owned by the machine and not a user. The key material that is generated is maintained in the security context of the security principal (user or computer account) that has created the request. When an administrator creates a certificate request on behalf of a computer, the key material must be created in the machine’s security context and not the administrator’s security context. Otherwise, the machine could not access its private key since it would be in the administrator’s security context.

You must set this key to TRUE if you are creating requests for domain controllers, a Web server, or any other service that runs in the machine’s security context.

Have a look at typical .inf file content:

[Version]

Signature="$Windows NT$

[NewRequest]

Subject = "CN=ad1.tailspintoys.com,OU=BTG,O=Microsoft,L=Atlanta,S=Georgia,C=US"

KeySpec = 1

KeyLength =  1024

Exportable = TRUE

MachineKeySet = TRUE

SMIME = FALSE

PrivateKeyArchive = FALSE

UserProtected = FALSE

UseExistingKeySet = FALSE

ProviderType =  12

RequestType =  PKCS10

ProviderName = "Microsoft RSA SChannel Cryptographic Provider"

KeyUsage =  0xf0

RequesterName =  Microsoft India.

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1

OID=1.3.6.1.5.5.7.3.2

Reference:

1. Certreq.exe syntax. https://technet.microsoft.com/en-us/library/cc736326.aspx

2. 321051  How to enable LDAP over SSL with a third-party certification authority

https://support.microsoft.com/default.aspx?scid=kb;EN-US;321051]]> https://docs.microsoft.com/archive/blogs/niraj_kumar/managing-windows-server-2008-core-with-powerful-commands-part1 Mon, 09 Feb 2009 20:08:56 GMT https://blogs.technet.microsoft.com/niraj_kumar/2009/02/09/managing-windows-server-2008-core-with-powerful-commands-part1/  

1. To join a domain

At a command prompt, type:

netdom join <ComputerName> /domain:<DomainName> /userd:<UserName> /passwordd:*

Where: ComputerName is the name of the server that is running the Server Core installation. DomainName is the name of the domain to join. UserName is a domain user account with permission to join the domain.

When prompted to enter the password, type the password for the domain user account specified by UserName.

2. If you need to add a domain user account to the local Administrators group, type the following command:

net localgroup administrators /add <DomainName>\<UserName>

3. Restart the computer.

You can do this by typing the following at a command prompt:

Shutdown /r /t 0

4. To activate the server

At a command prompt, type:

Cscript Slmgr.vbs –ato

]]>