Nachfolgend eine Übersicht über die vom Zertifikatregistrierungs-Richtliniendienst (CEP) erzeugten Ereignisse in der Windows-Ereignisanzeige.
Die Ereignisse des Zertifikatregistrierungs-Richtliniendienstes sind nicht offiziell dokumentiert. Die nachfolgende Liste wurde mit Hilfe des Tools Windows Event Log Messages (WELM) erzeugt.
Die Zertifikatregistrierungs-Webdienste (Certificate Enrollment Policy Web Service, CEP und Certificate Enrollment Web Service, CES) ermöglichen die automatische Beantragung und Erneuerung von Zertifikaten einer Zertifizierungsstelle über eine Webbasierte Schnittstelle. Somit ist kein direkter Kontakt zur Zertifizierungsstelle über Remote Procedure Call (RPC) notwendig. Für eine detailliertere Beschreibung siehe Artikel "Grundlagen Zertifikatbeantragung über Certificate Enrollment Web Services (CEP, CES)".
Ereignisquellen
Die Ereignisse des Zertifikatregistrierungs-Richtliniendienstes werden in das Anwendungs-Protokoll geschrieben. Folgende Quellen enthalten CEP-Ereignisse:
- Microsoft-Windows-EnrollmentPolicyWebService/Admin
Vordefinierte Ansicht in der Windows-Ereignisanzeige
Eine entsprechend gefilterte Ansicht ist in der Kategorie "Active Directory Certificate Services" auf jedem System, auf dem der Zertifikatregistrierungs-Richtliniendienst installiert ist, bereits vorkonfiguriert.
Ereignisquelle Microsoft-Windows-EnrollmentPolicyWebService
Kennen Sie TameMyCerts? TameMyCerts ist ein Add-On für die Microsoft Zertifizierungsstelle (Active Directory Certificate Services). Es erweitert die Funktion der Zertifizierungsstelle und ermöglicht die Anwendung von Regelwerken, um die sichere Automatisierung von Zertifikat-Ausstellungen zu realisieren. TameMyCerts ist einzigartig im Microsoft-Ökosystem, hat sich bereits in unzähligen Unternehmen auf der ganzen Welt bewährt und steht unter einer freien Lizenz. Es kann über GitHub heruntergeladen und kostenlos verwendet werden. Professionelle Wartung wird ebenfalls angeboten.
| ID | Typ | Ereignistext |
|---|---|---|
| 1 | Information | The Certificate Enrollment Policy Web Service has started. |
| 2 | Information | A service end point with URI %1 has been configured for this service. The client authentication scheme is %2. Use the Group Policy Management Console or the Certificates snap-in to configure clients with this Certificate Enrollment Policy Web Service information. |
| 3 | Warnung | A service end point with URI %1 has been configured for this service. The configuration of the client authentication scheme or the binding is not recommended. To fix the issue, open the web.config file and verify the binding and security settings. The only supported binding type for this service is wsHttpBinding. The security mode should be either Transport or TransportWithMessageCredential. When the security mode is Transport, the ClientCredentialType should be either Windows or Certificate. When the security mode is TransportWithMessageCredential, the ClientCredentialType should be UserName. |
| 4 | Fehler | The Certificate Enrollment Policy Web Service failed to initialize. Confirm that the Certificate Enrollment Policy Web Service is properly installed. Try to restart Internet Information Services (IIS) by using iisreset.exe. If the problem persists, enable tracing in the web.config file, restart IIS, attempt to obtain policy information from any client, and then contact Microsoft Customer Service and Support with the trace file information. %1 |
| 5 | Information | The Certificate Enrollment Policy Web Service has been stopped. |
| 6 | Information | The Active Directory certificate enrollment policy provider has been initialized to target the "%1" domain controller. |
| 7 | Information | The Active Directory certificate enrollment policy provider has been initialized to target the default domain controller for the current domain. |
| 8 | Fehler | The Active Directory certificate enrollment policy provider failed to initialize. Try to restart Internet Information Services (IIS) by using iisreset.exe. If the problem persists, enable tracing in the web.config file, restart IIS, attempt to obtain policy information from any client, and then contact Microsoft Customer Service and Support with the trace file information. %1 |
| 9 | Fehler | The Active Directory certificate enrollment policy provider failed to obtain policy information from Active Directory Domain Services (AD DS). The provider will attempt to read the information again in %1 milliseconds. If the problem persists, enable tracing in the web.config file, enable logging by using "certutil -setreg debug 0xffffffe3", restart IIS by using iisreset.exe, attempt to obtain policy information from any client, and then contact Microsoft Customer Service and Support with the information in the trace files and certenroll.log file. %2 |
| 10 | Warnung | There is no enterprise certification authority (CA) configured with the Certificate Enrollment Web Service in the current forest. Confirm that at least one enterprise CA is available in the forest and that at least one server running the Certificate Enrollment Web Service is configured to work with this CA. |
| 11 | Warnung | No certificate templates in the forest are configured to be sent as part of the policy response. Confirm that the server hosting the Certificate Enrollment Policy Web Service has Read permission to the required templates in this forest and that at least one server hosting the Certificate Enrollment Web Service is configured to work with the certification authorities (CAs) configured to issue the required templates. |
| 12 | Fehler | The certification authority (CA) "%1" cannot be sent as part of the policy response. Confirm that this CA is running and that at least one Certificate Enrollment Web Service is configured to use this CA . %2 |
| 13 | Fehler | The certificate template "%1" cannot be sent as part of the policy response. Use the Certificate Templates snap-in to confirm that this is a valid certificate template. Also confirm that at least one running certification authority (CA) has this template enabled and that at least one Certificate Enrollment Web Service is configured to use this CA. %2 |
| 14 | Fehler | The certification authority (CA) "%1" associated with the template "%2" cannot be sent as part of the policy response. Confirm that the CA is running and that at least one Certificate Enrollment Web Service is configured to use this CA. %3 |
| 15 | Fehler | The URI %2 used by the Certificate Enrollment Web Service for certification authority (CA) "%1" is invalid. Use Server Manager to configure the Certificate Enrollment Web Service to use a valid CA. %3 |
| 16 | Information | A certificate template %1 has been loaded. For additional information, please refer to the EventData section of the Details pane. |
| 17 | Information | A certification authority %1 has been loaded. For additional information, please refer to the EventData section of the Details pane. |
| 18 | Information | For a list of the OIDs which are loaded please refer to the "Details" pane. |
| 19 | Fehler | The Certificate Enrollment Policy Web Service cannot operate because Windows authentication is not compatible with key based renewal. To resolve this issue, remove the Certificate Enrollment Policy Web Service. Reconfigure the Setup options to disable key based renewal, or select either user name and password authentication or client certificate authentication, and then run Setup again. |
| 20 | Information | A service end point with URI %1 has been configured for this service. The client authentication scheme is %2. Only policies that contain certificate templates that are enabled for key based renewal will be returned to the client. Use the Group Policy Management Console or the Certificates snap-in to configure clients with this Certificate Enrollment Policy Web Service information. |
| 21 | Information | A service end point with URI %1 has been configured for this service. The client authentication scheme is %2. Only policies that contain certificate templates that are enabled for key based renewal will be returned to the client. Client certificates without subject information in the Active Directory database can be used to retrieve certificate templates. Use the Group Policy Management Console or the Certificates snap-in to configure clients with this Certificate Enrollment Policy Web Service information. |
Weiterführende Links:
- Übersicht über die von der Zertifizierungsstelle generierten Windows-Ereignisse
- Übersicht über die vom Onlineresponder (OCSP) generierten Windows-Ereignisse
- Übersicht über die vom Registrierungsdienst für Netzwerkgeräte (NDES) generierten Windows-Ereignisse
- Übersicht über die vom Zertifikatregistrierungs-Webdienst (CES) generierten Windows-Ereignisse
Externe Quellen
- Windows Event Log Messages (WELM) (GitHub)
Deutsch 
English
Ein Gedanke zu „Übersicht über die vom Zertifikatregistrierungs-Richtliniendienst (CEP) generierten Windows-Ereignisse“
Kommentare sind geschlossen.