Microsoft KB Archive/281271

= Certification Authority configuration to publish certificates in Active Directory of trusted domain =

Article ID: 281271

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server

-



This article was previously published under Q281271



SYMPTOMS
In the following scenario, if a user from the same domain as a Root certification authority (CA) requests a certificate, the issued certificate is published in Active Directory. However, if the user is from a child domain, this process is not successful. Also, when users from the same domain as a Root CA request a certificate, the issued certificate may not be published in Active Directory.

Scenario: In a two-level domain hierarchy with a parent and a child domain, the Enterprise CA is located in the parent domain, and the users are in the child domain. The users in the child domain enroll to the parent CA, and the CA publishes issued certificates to the user's DS object in the child domain. Within a single-level domain or a parent domain, where the Enterprise CA is located in the parent domain, the users in the single-level or parent domain enroll to the single-level CA or to the parent CA, and the CA publishes issued certificates to the user's DS object in the single-level domain or in the parent domain.



Two-level domain hierarchy scenario
Users from the child domain do not have appropriate permissions to enroll. Even when they do, the Root CA does not have the access permissions to publish the certificate to Active Directory.

By default, only domain users from the same domain as the Root CA have enroll permissions.

By default, the Root CA has the following necessary permissions granted on users within its domain:
 * Read userCertificate
 * Write userCertificate

The Root CA in the parent domain does not have permissions to the userCertificate property on the users in the child domain.

Single-level domain or parent domain scenario
By default, the AdminSDHolder object does not grant the Cert Publishers group the necessary permissions for user accounts that are covered under the AdminSDHolder process.



Two-level domain hierarchy scenario
To enable the child domain users to get certificates and have them published to Active Directory, you must perform the following steps:
 * 1) Set the permissions on the CA's template to allow enrollment requests. Set the user object permissions to allow the CA to publish the certificate. Alter AdminSDHolder to push the user object permissions to users that are administrators.
 * 2) Set the user object permissions to allow the CA to publish the certificate. Alter AdminSDHolder to push the user object permissions to users that are administrators.
 * 3) Alter AdminSDHolder to push the user object permissions to users that are administrators.

Note You must first install Support Tools from the Windows Professional, or Windows Server CD-ROM.

To enable the child domain users to get certificates and have them published to Active Directory
 Set permissions on the CA to allow users in the child domain to request a certificate. By default, this should be in place.  Open the Certification Authority snap-in, right-click the CA, and then click Properties. On the Security tab, ensure that the Authenticated Users group is allowed to request certificates.  Set permissions on the applicable certificate templates to allow users in the child domain to enroll. (Note You must be logged onto the root domain with domain administrator rights.)  Open the Active Directory Sites and Services snap-in.</li> Click View, and then click Show Services Node.</li> Expand the Services Node folder, expand Public Key Services, and then click Certificate Templates.</li> In the Details pane, select the desired template, or templates. For example, right-click the User certificate template, and then click Properties.</li> On the Security tab, grant enroll permissions to the desired group, such as Authenticated Users.</li></ol> </li>  Configure the CA Exit Module to publish certificates to Active Directory.  In the Certification Authority snap-in, right-click the CA, and then click Properties.</li> On the Exit Module tab, click Configure.</li> In the properties for the Exit Module, click to select the Allow certificates to be published in the Active Directory box.</li></ol>

On the child domain controller:
</li> Open the Active Directory Users and Computers snap-in, and right-click the domain node.</li> Click Delegate Control, at which point the Delegation wizard starts. In the wizard:  Click Next, click Add, and then add the Cert Publishers group from the parent domain. Click Next.</li> Select the Create a custom task to delegate option, and then click Next.</li> Select the Only the following objects in the folder.</li> Select the User objects option, and then click Next.</li> <li>Select the Property-specific option.</li> <li>Select the Read userCertificate option.</li> <li>Select the Write userCertificate option.</li> <li>Click Next, and then click Finished.</li></ol> </li> <li>Still on the child domain controller, at a command prompt, run the following two commands, keeping the quotation marks:

dsacls &quot;cn=adminsdholder,cn=system,dc= ,dc= &quot; /G &quot;<CA's domain>\Cert Publishers:WP;userCertificate&quot;

dsacls &quot;cn=adminsdholder,cn=system,dc= ,dc= &quot; /G &quot;<CA's domain>\Cert Publishers:RP;userCertificate&quot;

where dc= ,dc= is the distinguished name (DN) of your child domain, and where   is the domain name where the CA is located.</li></ol>

Single-level domain or parent domain scenario
On the single-level domain controller or on the parent domain controller, at a command prompt, run the following two commands, keeping the quotation marks:

dsacls &quot;cn=adminsdholder,cn=system, &quot; /G &quot; \Cert Publishers:WP;userCertificate&quot;

dsacls &quot;cn=adminsdholder,cn=system, &quot; /G &quot; \Cert Publishers:RP;userCertificate&quot;

where dc= ,dc= is the distinguished name (DN) of your child domain, and where   is the domain name where the CA is located.

Windows 2000 domains and Windows Server 2003 domains that have been upgraded from Windows 2000
The Cert Publishers group is a Domain Global group in Windows 2000 domains. This group is also a Domain Global groupin Windows Server 2003 domains that have been upgraded from Windows 2000. You can enable the child domain users to obtain certificates and have them published in upgraded Windows Server 2003 domains. To do this, change the group type to Domain Local, and include the CA server from the parent domain. This procedure creates the same configuration that is present in a freshly installed Windows Server 2003 domain. The user interface (UI) does not let you change the group type. However, you can use the dsmod command to change the Cert Publishers group from a Domain Global group to a Domain Local group. To do this, use the following syntax:

dsmod group Group Distinguished Name -scope l

Note In some cases, you cannot change groupType directly from global to domain local group. In this case you have to change the global group into an universal group and change the universal group into a domain local group. To do this, follow these steps: <ol> <li>Type the following command and then press ENTER:

dsmod group Group Distinguished Name -scope u

This command changes the global group into an univeral group.</li> <li>Type the following command and then press ENTER:

dsmod group Group Distinguished Name -scope l

This command changes the univeral group into a domain local group.</li></ol>

<div class="status_section">

STATUS
Microsoft has confirmed that this is a problem in Windows 2000 Server and in Windows Server 2003.

<div class="moreinformation_section">

MORE INFORMATION
When a user from a child domain does not succeed in enrolling, the following error is generated in the CA application event log:

<pre class="fixed_text">Event Type:    Warning Event Source:  CertSvc Event Category: None Event ID:      53 Date:          08/14/2000 Time:          05:13:00 User:          N/A Computer:      <Root CA name> Description: Certificate Services denied request <request #> because Access is denied. 0x80070005 (WIN32: 5). The request was for (Unknown Subject). Additional information: Denied by Policy Module

If the ACLs are set so that the user can enroll, but the CA does not have permissions to publish to the user's Active Directory, the following error is generated in the CA application event log:

<pre class="fixed_text">Event Type:    Error Event Source:  CertSvc Event Category: None Event ID:      46 Date:          08/14/2000 Time:          05:13:00 User:          N/A Computer:      <Root CA name> Description: The &quot;Enterprise and Stand-alone Exit Module&quot; Exit Module &quot;Notify&quot; method returned an error. Access is denied. The returned status code is 0x80070005 (5). The Certification Authority was unable to publish the certificate for Child\User to the Directory Service. Access is denied.

(0x80070005)

Keywords: kbcertservices kbprb KB281271

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.