Windows 10: Crashes due to Certificate Services Client

Hey I've been getting a lot of BSOD due to this event viewer log:SCEP Certificate enrollment initialization for WORKGROUP\LAPTOP-835T6E2P$ via https://AMD-KeyId-52fb59e29aa83a962fb9eef0fe5b4811de6b751e.microsoftaik.azure.net/templates/Aik/scep failed:GetCACapsMethod: GET47msStage: GetCACapsThe server name or address could not be resolved 0x80072ee7 WinHttp: 12007 ERROR_WINHTTP_NAME_NOT_RESOLVEDWondering if there is a fix for this

:)

 

Failed to connect to the group policy client services

Hi Mukul,

Thank you for posting in Community. I understand your concern and we will try to assist you in the best way we can.

The issue that you are facing may be due to the reasons stated below:

· User Profile Service or Group Policy Client service stopped working.

· Antivirus software conflicts.

· I would suggest that you first check if the services for Group Policy are running.

To do so follow the steps mentioned below
:

• Find the Group Policy Client service.
• Right click on the service, and click on Properties.
• The service status should be started and startup type
  automatic, if not, change the values accordingly, then click Apply and then OK.
• Press Windows + R key and type "services.msc" and press enter.
  

Let us know if this helps.

 

Certificate Templates on the client side

Hi,

Good day to you all! I hope this is the right place to ask this.

I have a few questions related to how certificate templates are being stored and distributed under AD CS:

• How do the clients get a list of applicable certificate templates from the enterprise CA, which is shown at the time when a new manual certificate enrollment is performed (e.g., someone goes to certmgr and request for a new certificate)?
• How are certificate templates being stored on both the CA side and the client side? Is there a directory that the templates reside in? Or are they just a collection of Windows registries (e.g. Software\Microsoft\Cryptography\CertificateTemplateCache
  under HKCU and HKLM)?
• Is it possible to programmatically read and parse certificate templates on the client side, ideally via some Microsoft provided public API? I am asking this because sometimes it is useful to check, verify and debug that
  
  a) clients are getting all the expected templates;
  
  b) the content of templates are as expected (particularly useful if there were templates of duplicated names, or an old template has its setting changed but the name is kept);
  
  c) applicable clients are indeed getting the same list of templates.

Please bear with me as I am a rookie to AD CS.

Thanks!

 

Radius server + WLC and Client Certificate Authentication

Hello people,

We have an issue with our radius server.

I will explain what is our goal and what configuration we have so far:

Our goal is to authenticate clients in the domain using WLC and Client Certificate Authentication.

Each client in our domain has a unique personal certificate.

The idea is when an employee opens his PC automatically connects to the specified by the GPO recommended network by using the certificate and not the username and password.



Currently, we configured the WLC Cisco controller to receive the client certificate, authenticate it and provide the IP address(of course if the policies are validated).

Afterward that the WLC controller has to send the request to the radius server. The radius should check if the certificate is valid (not expired) and not included in the revocation list.

Here our issue came. It seems that the radius cannot access the revocation list and cannot check if the certificate is revoked.

We validated that by disabling the revocation list check in the Radius server registry settings.

If we set it to ignore the revocation list check, the authentication succeeds, and the client is authenticated successfully.

The thing is that this way we lower the security of the connection significantly and we would like to make sure the certificate is validated against the revocation list.

At the same time, there are no issues in the connection between the RADIUS server and the server where the revocation list is stored/published.



Could you please let me know if there is any specific configuration that should be made in order for the radius to be able to check the status of the authenticated certificate in the revocation list?

Is there any configuration guide that we have to follow in order to implement the necessary configuration in the most proper way?