Dallas Data Center

The AutoEnrollment Event ID 13 can plague a Directory Service log within the Event Viewer. The problem with this error is the rate at which is it logged: every 6 hours. How do you catch an event that logs only once during business hours? You don’t: the issue is relatively simple to resolve. The problem occurs when the proper permissions for workstations/member servers of a domain cannot auto enroll with the certificate service. Usually, the first step is to ensure there is a CA (certificate authority) in the environment. This can be done by running the following command from the command prompt:

ldifde -f filename.txt -d “CN=Public Key Services,CN=Services,CN=Configuration,DC=domain,DC=com”

Note: If the CA returned in the results has been decommissioned, there are some steps to take to remove the remnants of this object at the end of the post.

Once a CA has been validated, there is a security group that a few other security groups will need to be members of. However, let’s first take a moment to understand why these impromptu errors occur. This happens when either of the two following situations arises: (1) either Windows Server 2003 SP1 has been introduced into the environment; or (2) Windows Server 2008 with ADCS role has been introduced into the environment. The first instance is due to a security change to DCOM settings and a new security group is created, CERTSVC_DCOM_ACCESS . Usually the error will prompt on workstations/servers that are not part of the immediate domain of the CA. Thus, the Domain Computers and Domain Controllers security groups need to be added to the “CERTSVC_DCOM_ACCESS” group.

When Windows Server 2008 ADCS is introduced, there are certificate templates that can be enabled for AutoEnroll permissions. This causes domain machines to attempt to request enrollment. However, if the following security groups are not members of the “Certificate Service DCOM Access” they will not have permission to request enrollment:

                Domain Computers

                Domain Controllers

Once the specified security groups – which are the same for both occasions – have been added and sufficient time allowed for replication, these events should cease.

Let’s say a CA was to have been decommissioned from the environment and these errors are suddenly being logged. Follow the steps below to remove the enrollment certificates and remnants of a CA that has been decommissioned:

1. Ensure the account used has the memberships below:
   1. Enterprise Administrator
   2. Domain Administrator
   3. Certificate Authority Administrator
   4. Schema Administrator
2. Start “Active Directory Sites and Services“.
3. Click the “View” menu option, and select “Show Services” node.
4. Expand the “Services“, and then expand “Public Key Services“.
5. Select the “AIA” node.
6. In the right-hand pane, locate the “certificateAuthority” object for your Certification Authority. Delete the object.
7. Select the “CDP” node.
8. In the right-hand pane, locate the Container object for the server where Certification Services is installed.
9. Delete the container and its contents.
10. Select the “Certification Authorities” node.
11. In the right-hand pane, locate the “certificateAuthority” object for your Certification Authority and delete the object.
12. Select the “Enrollment Services” node.
13. In the right-hand pane, verify the “pKIEnrollmentService” object for your Certification Authority and delete it.
14. Select the “Certificate Templates” node.
15. In the right-hand pane, delete all the Certificate Templates.

Note: Delete all the Certificate Templates only if no other Enterprise CAs are installed in the forest. If the templates are inadvertently deleted, restore the
templates from backup.

1. Click the “Public key Services” node and locate the “NTAuthCertificates” object.
2. If there are no other Enterprise or Stand-alone CAs installed in the forest, delete the object. Otherwise, leave it alone.
3. Use “Active Directory Sites and Services” or “Repadmin” command from the Windows resource kit to force replication to the other domain controllers in the domain/forest.

Sources:

http://support.microsoft.com/kb/903220/en-us

http://technet.microsoft.com/en-us/library/cc770546.aspx

http://support.microsoft.com/kb/555151

Submitted by Zack, Systems Engineer