How to Enable Notifications for Pending Certificate Requests

Anonymous — Thu, 12 Jul 2012 05:00:00 GMT

You can configure a Windows Certification Authority certificate template to require CA certificate manager approval, as shown below.

With this configuration autoenrollment is disabled and the CA Manager must approve the certificate request before the certificate is issued.

Normally, CA managers need to check in periodically to see if there are any pending requests to approve or decline. This article discusses how to enable email notifications when a certificate request is generated that requires approval.

First, my best practice is to create a mail-enabled security group in Active Directory called CA Managers. Add the appropriate user objects to this group and assign that group Issue and Manage Certificates and Manage CA rights on the Certification Authority, as shown below:

Now we need to configure event logging for Certificate Services for verbose logging. Run the following command from a CMD prompt on the CA:

certutil -setreg ca\loglevel 4

You must restart the Active Directory Certificate Services service (CertSvc) to affect the logging level change. The CA will now log event ID 54 from source CertificationAuthority in the Application event log whenever a certificate request is generated. For example,

Log Name:      Application
Source:        Microsoft-Windows-CertificationAuthority
Date:          7/12/2012 8:16:29 AM
Event ID:      54
Task Category: None
Level:         Information
Keywords:      Classic
User:          SYSTEM
Computer:      dc1.companyabc.com
Description:
Active Directory Certificate Services left request 51 pending in the queue for C=US, S=CA, L=Pacifica, O=Expta, OU=IT, CN=Admin, E=admin@companyabc.com. Additional information: Taken Under Submission

All we need to do now is create an Event trigger on this event. The easiest way to do that is to create a certificate request so we can attach a task to the event it logs. Once you create the certificate request, find the event ID 54 in the Application event log on the CA. Right-click the event and select Attach Task To This Event.

This will open the Create Basic Task Wizard which we will use to configure the email notification. Give the task a name and description, as shown below, and click Next:

The specific event details are prepopulated from the event we selected. Click Next:

Select Send an e-mail from the Actions list and click Next:

Complete the details for the email, as shown below. Enter the valid SMTP address for the CA Managers group (created above) in the To: field. I include the URL to the CA approval page in the message text for easy access by the CA Managers. Ensure that your CA server is allowed to send SMTP email to the SMTP server you designate in the wizard. I use Telnet to test that.

Review the summary. Select the check box to Open the Properties dialog for this task when I click Finish and then click Finish.

By default this task will only run when the user who created it is logged on. Change the task to run under the NT Authority\SYSTEM account by clicking the Change User or Group button and entering the local SYSTEM account. This will also configure the task to run whether the user is logged on or not. Now click OK to complete the task.

You can view, change or delete this task in the Event Viewer Tasks in the Task Scheduler Library.

Test the new configuration by generating another certificate request. All members of the CA Managers group should receive an email indicating that a new certificate request is pending, along with a link to the CA's web approval page, as shown below:

Fixing Time Errors on VMware vSphere and ESX Hosts

Anonymous — Tue, 19 Jul 2011 05:00:00 GMT

Time synchronization across a Windows domain is very important. If a member server's clock varies more than 5 minutes from other domain servers, Kerberos tickets will fail. This causes random authentication errors for users and/or applications which are sometimes difficult to troubleshoot.

Normally, time is synchronized in a Windows domain using the domain hierarchy. The domain controller holding the PDC Emulator FSMO role is normally configured to get time from an authoritative NTP time source, and syncs time with all the other DCs in the domain. The domain clients in each site sync time from the DCs in their local site, maintaining a relatively close synchronization of time across the domain.

Virtual machines are no different than physical computers and normally sync time using the same domain hierarchy. Lately, however, I've seen VMs running on VMware vSphere boot up with random time differences from the domain. I've seen this problem with three different clients lately, so I figured this might be a pervasive enough issue to blog about.

The trouble happens when the VMware vSphere, ESX or ESXi host does not have an accurate source of time, or time "drifts" due to an inaccurate system clock module. vSphere and ESX hosts run a proprietary operating system and are not domain member servers, therefore they do not participate in domain hierarchy time synchronization.

Most companies that use VMware hosts use vCenter to manage these hosts and their VMs. Often, the servers that run vCenter are domain member computers and administrators think that since the vCenter syncs time with the domain, the hosts and VMs do, too. Not true. You need to configure the vSphere or ESX hosts to sync time from an accurate time source, otherwise the VM guests may start up with the wrong time - this can happen even if time synchronization between the virtual machine and the ESX server in VMware Tools is not enabled.

Here's how to configure your vSphere or ESX hosts to get time from an authoritative source.

Logon to vCenter and select your vSphere or ESX host.
Click the Configuration tab and then Time Configuration under the Software heading. Notice that the time on the vSphere host does not match the domain time shown on the Windows client running vCenter .

Click Properties in the top left of the Configuration tab. This opens the Time Configuration window.

Click the Options button and add a new NTP server that is the accurate source of time. I recommend using the PDC emulator, since it should already be configured as an authoritative time source.

Select the checkbox to Restart NTP service to apply changes and click OK twice to close the Time Configuration window. You will see that the vSphere/ESX host now has the correct time and is configured to use dc01.companyabc.com as its time server.

You may need to restart the VM guests running on that VMware host to have them sync time with the domain. The Windows Time service will not correct the time on the VMs if it varies too much from domain time. All domain computers sync time when they start up on the domain, regardless of how far out of sync they were.

I have not seen this type of behavior with Hyper-V, only vSphere, ESX and ESXi hosts.

Search results for 'app:weblogs' matching tags 'troubleshooting', 'tip', and 'Windows'

How to Enable Notifications for Pending Certificate Requests

Fixing Time Errors on VMware vSphere and ESX Hosts