|
Posted by =?Utf-8?B?SmFtZXMgQnVsbG9jaw== on February 21, 2007, 5:25 pm
If you were Registered and logged in, you could reply and use other advanced thread options
Oddly, all the things i'm reading with regards the problems i'm having
getting users to be able to enrol certificates - seem to be about people
having problems with auto-enrollment for DC's, which seems to work perfectly
first time in this infrastructure.
Given the first CA is in one of the child domains as opposed to the root
domain, could this be part of my issue - to do with the permissions anyhow?
Not sure of sensible next step, any pointers appreciated.
Cheers,
Jim
"James Bullock" wrote:
> Dear all,
>
> Have just implemented a W2003 pki for our 3 domain forest, the issuing CA is
> a w2003 enterprise box, not a dc but installed as part of one of the child
> domains in the forest under an enterprise admins account.
>
> pkiview tells me everything is fine, and domain controllers are
> auto-enrolling just fine within the child domain hosting the CA, outside in
> the other child domains they aren't but thats an issue with Cert Publishers
> membership that i am confident i can resolve by changing the scope of the
> groups.
>
> but the fix does not work in our situation. The fix i am referring to is to
> run certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG if the
> CERTSRV_DCOM_ACCESS group is missing from the users container in the ad.
> Which it is. Running this generates no errors, but does not create the
> group....
>
> I feel i should also mention that our root domain within the forest was
> upgraded from w2000 to 2003, but due to an administrative oversight, the
> schema was updated to R2 before sp1 was applied to the schema master. Not
> sure if this is related.
>
> Essentially i need to have the group so i can add the relevant groups so my
> users are able to request certificates, at the moment only ent admins can,
> everyone else receives the following message
>
> The wizard cannot be started because of one or more of the following
> conditions:
> - There are no trusted certification authorities (CAs) available.
> - You do not have the permissions to request certificates from the available
> CAs.
> - The available CAs issue certificates for which you do not have permissions.
>
>
> Any ideas? Any advice welcomed!
>
> Best,
>
> Jim Bullock
>
>
| 
XML site map