Collection Rule for event with source CertificationAuthority and ID 107

Summary

Active Directory Certificate Services (AD CS) requires at least Read access, and in some instances Write access, to certain objects in Active Directory Domain Services (AD DS). Failure to access these Active Directory objects can prevent AD CS from starting.

Resolutions

Enable AD CS to delete a CA certificate from Active Directory Domain Services

To enable Active Directory Certificate Services (AD CS) to delete the certification authority (CA) certificate identified in the event log message from Active Directory Domain Services (AD DS):

• Confirm that the CA has necessary permissions to essential AD DS containers and objects.

• Confirm that the CA certificate exists in the AIA container.

• Confirm the status of the CA certificate.

• After these conditions have been addressed, delete the certificate manually.

To perform this procedure, you must have membership in Domain Admins, or you must have been delegated the appropriate authority on the domain controller.

Confirm permissions on essential AD DS containers and objects

To confirm that the CA has necessary permissions on AD DS containers and objects within these containers:

• On a domain controller, click Start, point to Administrative Tools, and click Active Directory Sites and Services.

• Click Active Directory Sites and Services [domainname] where [domainname] is the name of your domain.

• On the View menu, click Show Services Node.

• Double-click Services, double-click Public Key Services, and right-click each container listed below, or the objects listed within the container, and click Properties. 

• On the Security tab, confirm the required permissions.

The following are all Active Directory permissions required by a computer hosting a CA. Some of these permissions are achieved via membership in the Cert Publishers group.

• Enrollment Services container. The CA computer has Read and Write access to its own object.

• AIA container. The Cert Publishers group has Full Control access on the AIA container and the CA computer has Full Control access on its own object within the AIA container.

• CDP container. The Cert Publishers group has Full Control access on every CA's container under the CDP container, and the CA computer has Full Control access on every certification revocation list (CRL) object in its own container.

• Certification Authorities container. The Cert Publishers group has Full Control access on the objects within this container.

• Certificate Templates container. The Enterprise Admins and Domain Admins groups (not the CA computer) have Full Control access or Read and Write access to this container and to most objects within it.

• KRA container. The CA computer has Full Control access on its own object. 

• OID container. The Enterprise Admins and Domain Admins groups, not the CA computer, have Full Control access or Read and Write access to this container and to the containers and objects within it.

• NTAuthCertificates object. The Enterprise Admins and Domain Admins groups, not the CA computer, have Full Control access or Read and Write access.

• Domain Computers and Domain Users containers. The Cert Publishers group has Read and Write permissions on the userCertificate property of each user and computer object in the forest in which AD CS is deployed.

To perform these procedures, you must have Manage CA permission, or you must have been delegated the appropriate authority.

Confirm that the CA certificate exists in the AIA container

To view the contents of the AIA container in AD DS:

• Open a command prompt window.

• Type certutil -cainfo and press ENTER.

• In the output of the command, note the property listed after Sanitized Short Name.

• Type the following command, and press ENTER: certutil -viewstore ldap:/// CN=<MyCA>,CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=<contoso>,DC=<com>?cACertificate?base?objectclass=certificationAuthority

Replace MyCA with the Sanitized Short Name property from step 3 and replace contoso and com with the Lightweight Directory Access Protocol (LDAP) distinguished name of your Active Directory root domain.

Confirm CA certificate status

To confirm the status of the CA certificate identified in the event log message:

• Open a command prompt window.

• Type certutil -verify ldap:///CN=<MyCA>,CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=<contoso>,DC=<com>?cACertificate?base?objectclass=certificationAuthority and press ENTER.

• If the certificate should have been deleted and was not, you can deleted it manually with the procedure "Delete the CA certificate manually."

Delete the CA certificate manually

To delete the CA certificate manually:

• Open a command prompt window.

• Type certutil -viewdelstore ldap:///CN=<MyCA>,CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=<contoso>,DC=<com>?cACertificate?base?objectclass=certificationAuthority and press ENTER.

• Select the CA certificate to delete, and click OK.

Additional

To check the connection between a CA and Active Directory Domain Services (AD DS):

• Open a command prompt window on the computer hosting the CA.

• Type nltest /sc_verify: [domainname] and press ENTER.

• Use the following procedure to confirm permisssions on essential AD DS containers and objects.

Replace [domainname] with the name of the namespace in which the CA is installed.

Confirm permissions on essential AD DS containers and objects

To perform this procedure, you must have membership in Domain Admins, or you must have been delegated the appropriate authority.

To confirm that the CA has necessary permissions on AD DS containers and objects within these containers:

• On a domain controller, click Start, point to Administrative Tools, and click Active Directory Sites and Services.

• Click Active Directory Sites and Services [domainname] where [domainname] is the name of your domain.

• On the View menu, click Show Services Node.

• Double-click Services, double-click Public Key Services, and right-click each container listed below, or the objects listed within the container, and click Properties.

• On the Security tab, confirm the required permissions.

The following are all Active Directory permissions required by a computer hosting a CA. Some of these permissions are achieved via membership in the Cert Publishers group.

• Enrollment Services container. The CA computer has Read and Write access to its own object.

• AIA container. The Cert Publishers group has Full Control access on the AIA container and the CA computer has Full Control access on its own object within the AIA container.

• CDP container. The Cert Publishers group has Full Control access on every CA's container under the CDP container, and the CA computer has Full Control access on every certification revocation list (CRL) object in its own container.

• Certification Authorities container. The Cert Publishers group has Full Control access on the objects within this container.

• Certificate Templates container. The Enterprise Admins and Domain Admins groups (not the CA computer) have Full Control access or Read and Write access to this container and to most objects within it.

• KRA container. The CA computer has Full Control access on its own object.

• OID container. The Enterprise Admins and Domain Admins groups, not the CA computer, have Full Control access or Read and Write access to this container and to the containers and objects within it.

• NTAuthCertificates object. The Enterprise Admins and Domain Admins groups, not the CA computer, have Full Control access or Read and Write access.

• Domain Computers and Domain Users containers. The Cert Publishers group has Read and Write permissions on the userCertificate property of each user and computer object in the forest in which AD CS is deployed.