Active Directory Certificate Services Cross-Forest Enrollment

AD CS: Troubleshooting Cross-forest Certificate Enrollment

Download 312 Kb.

Page	13/15
Date	04.02.2024
Size	312 Kb.
	#63423

1 ... 7 8 9 10 11 12 13 14 15

ADCS Cross Forest Enrollment

AD CS: Troubleshooting Cross-forest Certificate Enrollment

Common problems and resolutions related to using AD CS for cross-forest certificate enrollment are described.

PKI object synchronization issues

If the PKI objects are not the same in all forests, a number of problems can occur during certificate enrollment. For example, domain members may receive errors indicating certificate template version number inconsistencies.
You must ensure that the same set of PKI objects and certificate templates exist in all forests and that the attribute values on each object are the same across forests.
To compare the objects in two forests, use the command .\PKISync.ps1 -sourceforest -targetforest -whatif. By using the –whatif switch, the script will display the objects that would be copied but does not copy them. If the output for an object does not include the message "Object exists, use -f to overwrite", then the object exists in but not in .
To display an object’s attribute values, use the DumpADObj.ps1 script included in this guide. See AD CS: DumpADObj.ps1 Script for Cross-forest Certificate Enrollment.
To compare the attribute values of two objects in different forests, use DumpADObj.ps1 for each object. Use a program to compare the output files for the two objects. If WinDiff.exe is not included in the version of Windows you are using, see Windows XP Service Pack 2 Support Tools.
To display the PKI objects in AD DS, use the command certutil –viewstore [].
 To view root CA certificates, use cerutil –viewstore "ldap:///CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=?cACertificate?one?objectClass=certificationAuthority" []
 To view enterprise CA certificates in the NTAuthCertificates container, use certutil viewstore "ldap:///CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=?cACertificate" []
 To view enterprise CA certificates in the AIA container, use certutil -viewstore "ldap:///CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,DC=?cACertificate?one?objectClass=certificationAuthority" [].

Download 312 Kb.

Share with your friends:

1 ... 7 8 9 10 11 12 13 14 15