Details of the event with ID 19 of the source Microsoft-Windows-Kerberos-Key-Distribution-Center

Author Uwe GradeneggerPosted on Categories Active Directory, Events, Certificate usageTags
Event Source:Microsoft Windows Kerberos Key Distribution Center
Event ID:19 (0x80000013)
Event log:System
Event type:Warning
Event text (English):This event indicates an attempt was made to use smartcard logon, but the KDC is unable to use the PKINIT protocol because it is missing a suitable certificate.
Event text (German):This event indicates that an attempt was made to use the smart card login, but the KDC cannot use the PKINIT protocol because a suitable certificate is missing.

Example events

This event indicates an attempt was made to use smartcard logon, but the KDC is unable to use the PKINIT protocol because it is missing a suitable certificate.

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

Description

This message occurs when a logon is performed via smartcard, but the domain controller's certificate does not have any of the required extended key usage (Extended Key Usage) disposes

The event occurs together with the Event no. 29.

This is the case, for example, when a customized security-hardened certificate template is used for the domain controllers, which does not allow smartcard enrollment.

See also article "Signing in via smartcard fails with error message "Signing in with a security device isn't supported for your account."„.

Can also occur when the domain controllers cannot check the revocation status of their own certificates, for example, because the revocation list distribution points are offline.

More information

Safety assessment

The security assessment is based on the three dimensions of confidentiality, integrity and availability.

If security-hardened certificate templates are used which do not allow logon via smartcard, this event may indicate an unauthorized logon attempt as well as compromise of a certification authority. In this case, it would be rated as "critical" in terms of integrity.

For a description of the underlying problem, see the article "Attack vector on Active Directory directory service via smartcard logon mechanism„.

Related links:

External sources

en_USEnglish
de_DEDeutsch en_USEnglish