Home
  •  

具有源 CertificationAuthority 和 ID 83 的事件的收集规则

Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.83 (Rule)

证书服务在加载 key recovery agent 证书时出错。

Knowledge Base article:

摘要

Active Directory 证书服务 (AD CS) 需要 key recovery agent 证书、交换 (XCHG) 证书和密钥才能支持密钥存档。对于公钥基础设施而言，key recovery agent 证书、XCHG 证书以及创建这些证书所需的加密服务提供程序 (CSP) 是否正常工作至关重要。

解决方案

配置适当的 key recovery agent 证书数量

请确保证书颁发机构 (CA) 有适当数量的有效的 key recovery agent 证书。需要的 key recovery agent 证书数量在证书颁发机构管理单元的“恢复代理”选项卡上设置。

要执行此过程，您必须拥有管理 CA 的权限，或者您必须被委派了适当的权限。

要确认 key recovery agent 证书的具体问题，请执行以下操作：

有关详细信息，请参阅 http://go.microsoft.com/fwlink/?LinkID=95698。

其他

要确认密钥存档和恢复是否正常，请执行以下操作：

Element properties:

TargetMicrosoft.Windows.CertificateServices.CARole.2016
CategoryEventCollection
EnabledTrue
Event_ID83
Event SourceMicrosoft-Windows-CertificationAuthority
Alert GenerateTrue
Alert SeverityError
Alert PriorityHigh
RemotableTrue
Alert Message
AD CS 密钥存档和恢复 - 无法加载 KRA
事件说明:{0}
Event LogApplication

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Microsoft.Windows.EventProvider Default
Alert WriteAction System.Health.GenerateAlert Default
WriteToCertSvcEvents WriteAction Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher Default
WriteToDB WriteAction Microsoft.SystemCenter.CollectEvent Default

Source Code:

<Rule ID="Microsoft.Windows.CertificateServices.CARole.2016.CertSvcEvents.83" Enabled="true" Target="CSDisc!Microsoft.Windows.CertificateServices.CARole.2016" ConfirmDelivery="true" Remotable="true" Priority="Normal" DiscardLevel="100">

  <Category>EventCollection</Category>

  <DataSources>

    <DataSource ID="DS" TypeID="Windows!Microsoft.Windows.EventProvider">

      <ComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ComputerName>

      <LogName>Application</LogName>

      <Expression>

        <And>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="UnsignedInteger">EventDisplayNumber</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="UnsignedInteger">83</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

          <Expression>

            <SimpleExpression>

              <ValueExpression>

                <XPathQuery Type="String">PublisherName</XPathQuery>

              </ValueExpression>

              <Operator>Equal</Operator>

              <ValueExpression>

                <Value Type="String">Microsoft-Windows-CertificationAuthority</Value>

              </ValueExpression>

            </SimpleExpression>

          </Expression>

        </And>

      </Expression>

    </DataSource>

  </DataSources>

  <WriteActions>

    <WriteAction ID="WriteToDB" TypeID="SC!Microsoft.SystemCenter.CollectEvent"/>

    <WriteAction ID="WriteToCertSvcEvents" TypeID="Microsoft.Windows.CertificateServices.CARole.CertSvcEvents.Publisher"/>

    <WriteAction ID="Alert" TypeID="Health!System.Health.GenerateAlert">

      <Priority>2</Priority>

      <Severity>2</Severity>

      <AlertMessageId>$MPElement[Name="AlertMessageID887fa092475a4f92804af124cf8eff1c"]$</AlertMessageId>

      <AlertParameters>

        <AlertParameter1>$Data/EventDescription$</AlertParameter1>

      </AlertParameters>

      <Suppression>

        <SuppressionValue>$Data/EventDisplayNumber$</SuppressionValue>

        <SuppressionValue>$Data/PublisherName$</SuppressionValue>

        <SuppressionValue>$Data/LoggingComputer$</SuppressionValue>

      </Suppression>

    </WriteAction>

  </WriteActions>

</Rule>