ADLDS SSL - fatal error occured when attempting to access the SSL server credential private key

-

hi all,

i having trouble installation of internal domain pki cert on adlds.  have used pki other server ssl know part valid.

upon import of pfx computer personal certificates, have verified okay via indication have private key corresponds certificate.  checking certification path, leads root pki , well.

i restart adlds , try connect ssl , no go.  server event logs indicate schannel error:

a fatal error occured when attempting access ssl server credential private key.  error code returned cryptographic module 0x8009030d.  internal error state 10001.

following ms adlds instructions ssl states add network service rights machinekeys file.  doesnt type of rights assume read & execute.  unsure file change attributes apply of them.

restarting adlds instance doesnt solve problem.  tried launching certificates mmc , instead of computer, used service , picked adlds instance.  under personal imported pfx, restarted adlds, still no luck.

i doing file level audting on machinekeys folder , see security failures via network service.  gives?

hi,

 

based on process monitor, private key file trying access 4d0e9759c3974f256ec070ade1ad673f_***-*** in c:\programdata\microsoft\crypto\keys.

 

2:23:13.1867291 am      lsass.exe           480       createfile            c:\programdata\microsoft\crypto\keys\4d0e9759c3974f256ec070ade1ad673f_***-***       access denied            desired access: generic read, disposition: open, options: sequential access, synchronous io non-alert, non-directory file, attributes: n/a, sharemode: read, allocationsize: n/a, impersonating: nt authority\network service

 

it seems that cng being used in environment , therefore folder path different. please grant read permission network service on file , check result.

 

thanks.

this posting provided "as is" no warranties, , confers no rights. please remember click “mark answer” on post helps you, , click “unmark answer” if marked post not answer question. can beneficial other community members reading thread.


Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

Edit Group Policy

-
i have pc has power settings pushed out default domain policy in ad environment. of course on local machine "some settings managed system adminstrator". the machine temporarily no longer in contact domain controller (it's been physically moved , not on same network now) can't updated gpo settings. i believe if edit local group policy won't make difference because of group policy processing , precedence. since it's temporary away ad network, still want use settings of ad user. is there somewhere in registry stored can edit power plan manually until can sync domain? (i need prevent sleeping while plugged in - it's set 1 hour) thanks! allen crist i found site: http://gpsearch.azurewebsites.net/#7916 i able add policy to hkey_local_machine\software\policies\microsoft\power using specs found on site. looks solved issue. i'll report if didn't. thanks! allen crist ...
Read more

Hyper-V VM not reaching OS 'Logon' screen

-
i trying migrate vm vmware hyper-v. so far have done following (seemingly successfully): prepare vmware vm conversion hyper-v format (vhd) within vmware workstation 8.0 environment following steps guide: http://social.technet.microsoft.com/forums/en/winserverhyperv/thread/ef8c12f7-c45d-442e-9a30-c43cd87df3b3   (i.e. remove vm tools, add new ide hard disk…) use vmdk2vhd application convert individual vmdk files vhd ones create new vm in hyper-v exporting in 3 newly converted vhd files at point have checked settings , powered on vm in hyper-v find although windows begins load expected manages reach screen prior login screen saying either of following messages: “windows starting up…” “the active directory rebuilding indices… please wait” to knowledge, albeit limited in area, vm should present me login screen since appears in vmware. if start vm in safe mode can login not desired affect. below details of vm: operating system: windows server 2003 (enterprise edit...
Read more

DNS question...

-
i new setting dns server....my domain name expl. "domain.com"....i set "a" record in forward lookup for  www.domain.com itself...."server's local ip"....i've added no other zones , i seem able resolve names except own....www.domain.com.....also, do i put my isp's dns ip's....for external dns's server can't resolve?....forwarding or in nic setup?......i want setup in my dns server don't have include them on client side..... thanks mark     not put isp dsn server address in settings on nic dc or clients. should point local dns server on dc. set dns forward public dns, such isp. bill Windows Server  >  Network Infrastructure Servers
Read more