Certificate Service placement on a DC

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Lose ability to decrypt EFS files after reboot We've been wrestling with a problem computer for a few days now and was hoping these symptoms ring a bell with someone. After a reboot, when we attempt to read files in an directory with the encryption property set, the data is does not appear to be decrypted. That is, we see junk where we should see simple ascii text. Everything works fine until the computer is rebooted. It works fine after logouts and logins. After a reboot, none of the accounts formerly able to access the file, including manually added certs and the recovery agent, are able to read anything but garbage from the file. We create a new account and encrypt files and it works fine until the computer is rebooted again. This is true of local or domain accounts. When the problem first appeared, the computer was not joined to a domain. All EFS certs are of the automatically generated, self-signed type. The computer is a new Vista computer. All the account certs and thumb prints appear unchanged before and after the reboot. I suspect the problem would go away if we rebuilt the computer but as we're familiarizing ourselves with EFS before a wider roll-out, I'd really like to define the problem and what caused it in case we run into it again. -- Gary Flynn Security Engineer James Madison University www.jmu.edu/computing/security Tag: Certificate Service placement on a DC Tag: 91718
  - 2
    - Cannot Request Certificate Clients in a child domain cannot request certificates from the issuing CA which is located in the root domain. I get the error The wizard cannot be started because of one or more of the following conditions: -There are no trusted certification authorities (CAs) available. -You do not have permission to request certificates from the available CAs -The avaiable CAs issue certificates for which you do not have permission. Clients in the root domain can request new certificates. Permissions on the CA are set that Authenticated Users can request certificates. The setup is all Win2003 Servers/AD and XpSP2 Clients Tag: Certificate Service placement on a DC Tag: 91717
  - 3
    - Error parsing Request: The request subject name is invalid or too long. 0x80094001 (-2146877439) I have an offline Enterprise CA based on Windows Server 2003 Standard. I am trying to sign a certificate request generated from a Windows Server 2003 Enterprise R2 CA. When I choose submit new request on the offline CA, I get this error. I have no idea what the error means. Some guesses though :-) : - There is something wrong with the format of the name. I would have hoped the R2 online issuing CA would have told me what is wrong with the name - The name is too long maybe? Again, I dont really know how long the name can be, but I dont think the names I have chosen are ridiculously long. Am I missing the boat on this one? I am using Brian Komar's excellent reference as a guidepost, and dont see anything in there that can help me with this one. I did find one other thread via google, but it seemed to be related to cross certification, and I am not doing anything like that. Any help greatly appreciated.... Thanks, Joe Tag: Certificate Service placement on a DC Tag: 91713
  - 4
    - Europe Tests Established Chemicals on Millions of Animals Tony Nottingham England 26 February 2007 TO: All People Who Care A new European Chemical Testing Policy called REACH has now been finalised by the European Union. Under these proposals Chemicals of every kind - from those used in industrial processes to the ingredients of consumer products - will be tested on Millions of animals from mice to fish to dogs, causing untold suffering. Still worse, because of this reliance on outdated animal techniques, reliable and relevant information will not be provided and our safety will not be assured. If you believe that REACH should make more use of Alternative Testing to test 1000s of Chemicals that have been in general use since before 1985 then please take action now. If you are a European citizen please contact your local papers and own MEP asking them to promote the development of humane non-animal testing methods under the REACH legislation, which is the best hope we have for sparing animals the misery of a testing laboratory. A sample letter can be found at the BUAV (British Union for the Abolition of Vivisection) website at www.BUAV.org (Select Campaigns, Chemical Testing, Get Active then Writing to the local press). For all Non-European members, you can still help. Please tell all your colleagues and friends in the UK and Europe about REACH. Write to your own local papers to try and inform others about what is going on in Europe. The website for the European Parliament is http://www.europarl.europa.eu. Information on REACH, the New European Chemical Testing Policy can be found here. Everyone can help and you can make a difference. Thank You Tag: Certificate Service placement on a DC Tag: 91708
  - 5
    - AVG updated how often I just started using AVG anti virus. How often is it updated? I only installed it yesterday and today there was an update. I know it's irregular. As much as I hated Norton AV, it wouldn't display something when updating. Tag: Certificate Service placement on a DC Tag: 91707
  - 6
    - Auto Enrolled DC certificate failed to publish Due to a permissions issue my new certificate services deployment didn't work as planned. All of my DC's autoenrolled but the certifiate couldn't be published to the child domains. I believe the permissions issue is now sorted, do I need to do anything to publish the existing certificates or will they automatically publish to AD. Thanks Scott Tag: Certificate Service placement on a DC Tag: 91701
  - 7
    - ad pop ups i filled a form out and now i get a ad that has the name of my home town and towns nearby i ran adaware ,searh and destroy ,cclrean, tweak now, and avg free but still have the ad i blocked all third party cookies still there is there anything else i can do i ran hijack this but im not sure where to post the log does anyone know how to remove this ad i downloaded different pop up blockers and thay didnt work someone please hel Tag: Certificate Service placement on a DC Tag: 91694
  - 8
    - Pushing Registry settings via GPO I know that this should be able to be done, but I can't find any documentation on how to do it. Can anyone point me in the right direction? Thanks. Tag: Certificate Service placement on a DC Tag: 91693
  - 9
    - Failed updates downloaded Hi, I was downloading updates from Microsoft links, I have Windows XP and 13 downloads fialed, all 2003 programmes with the letters KB then numbers. What went wrong? -- thanks for any help you can supply Tag: Certificate Service placement on a DC Tag: 91685
  - 10
    - basicwk.inf vs. defltwk.inf vs. setup security.inf Does anyone know what the difference is between these 3 security templates that come with Windows 2000: basicwk.inf (or basicsv.inf) defltwk.inf (or defltsv.inf) setup security.inf I've seen a few sites that say basicwk.inf (or basicsv.inf) contains the default settings for Windows 2000. But I've also seen a few sites that say defltwk.inf (or defltsv.inf) contains the default settings for Windows 2000. And I've also seen a few sites that say setup security.inf contains the default settings for Windows 2000. Tag: Certificate Service placement on a DC Tag: 91684
  - 11
    - MVP Comment FAO - Engel & Others Microsoft has set up (specific) newsgroups for Windows Defender Support. Please post your queries there, *not* here. <http://www.microsoft.com/athome/security/spyware/software/newsgroups/default.mspx> These are viewed, at least by me, as nuisance posts in *these* newsgroups. Thanks for your anticipated cooperation! Silj -- siljaline MS - MVP Windows (IE/OE) & Windows Security, AH-VSOP Security Tools Updates http://aumha.net/viewforum.php?f=31 Reply to group, as return address is invalid that we may all benefit. Tag: Certificate Service placement on a DC Tag: 91676
  - 12
    - inquiry on putting a block on changing internet settings on IE7 So I placed some sites in the restricted sites portion of the Internet settings and I want to make sure they stay there. To put it into more of a perspective, I want to make sure that a person who is not an administrator cannot edit the Internet settings, especially by removing sites from the restricted sites list. I am using IE7, if that helps/makes a difference. I have limited knowledge on editing registry keys, so if that's what needs to be done, and you can point me in the right direction, I can probably figure it out. But I'm having a heck of a time finding any info on how to set up those restrictions. Thank you in advance for your input. Tag: Certificate Service placement on a DC Tag: 91671
  - 13
    - MSecurity Is working at msecurity (information security company) www.msecurity.net EggHeadCafe.com - .NET Developer Portal of Choice http://www.eggheadcafe.com Tag: Certificate Service placement on a DC Tag: 91669
  - 14
    - Live Messenger Servic A relative wants me to install the new MSN Live Messenger: http://get.live.com/messenger/overview and to start using it to converse with her. To say that I am reluctant is an understatement. I have always viewed the messenger service as being an unnecessary risk that is too open and prone to abuse by the bad guys. Am I being over cautious? -- Regards, Sandy In Perth, the ancient capital of Scotland and the crowning place of kings sandymann2@mailinator.com Replace@mailinator.com with @tiscali.co.uk Tag: Certificate Service placement on a DC Tag: 91666
  - 15
    - How to Hook Programs to Explorer? I have a program that is hooking onto explorer, so when that application is executed it first executes some kind of installer then brings up explorer. Is this done through anything in the registry and if yes which paths? -- Will Tag: Certificate Service placement on a DC Tag: 91661
  - 16
    - Deny access to d drive by the guest My computer has both c and d drives and i am trying to configure the d drive so it is accessed by the administrator account and no the guest account. when attempting to change the permission on it, it will not allow me to. Anyone know how to fix this problem. Running xp home Tag: Certificate Service placement on a DC Tag: 91659
  - 17
    - Window Defender Daily Scan Stop Running Hi, My daily scan just stopped running. I can do a manual scan with no problem. I check the Task Scheduler service and it's running. I checked the Windows Defender service and it's running. I tried changing the scan time and that didn't work. The only thing I didn't do was remove Defender and reinstall. Can anyone offer any other suggestion? Thanks -- Kurt Tag: Certificate Service placement on a DC Tag: 91655
  - 18
    - Need Help! How do I get rid of this? I had a friend over, and he was trying to be nice by downloading a dvd player because I did not have one. However in his quest, he ended up downloading many a virus' and or spy/adware. When I next got on my computer I noticed 3 new dvd player programs and 3 or 4 anti virus/ad/spyware demo programs. This told me that he knew he made a mistake, and tried to remedy it, and didnt know what to do when the trials required money to fix the problems, so he left. This is the state I found my comp in when I next got on. I knew there were going to be problems and sure enough.... The fist thing I noticed was several balloons popping up from the lower right hand corner of the screen, informing me of what viruses/spyware there are, and click on them to fix the problems. All this did is send me to http://protectionband.com/ and all that does is try to get you to buy their software. I immediately uninstalled everything he downloaded, but the symptoms persist. I already had Spysweeper and Windows firewall running the whole time. So I did a full system sweep with Spysweeper with antivirus, and it found like 3 things. Quarantined them to no avail. Keep in mind these balloons are coming up like every 10 seconds. I tried logging on the internet and all it takes me to is that http://protectionband.com/ Which I know is a legal virus itself. I think it was one of the anti- programs he download that all these problems are remaining from. I think its this thats camoflaging itself to look like windows and system alert balloons. I beleive its the remnants from the anti-virus/spy/ad thats doing all of this. I was able to use the internet a little, so I went to norton 2007 and downloaded their trial from them. I thought I should live update first, but its so bad it inturrupts the live update. So I figured I scan the comp. first, then live update then scan it again. Its scanning now, so I dont know the outcome of it yet, Im expecting it to do nothing. Im asking what I should do if norton 2007 cant fix it. And on a side not on of those hundreds of pop up balloons said that the system was 37% infected Any help is appriciated thank you! Tag: Certificate Service placement on a DC Tag: 91649
  - 19
    - How to perform FULL CA backup Hi , I have tried to backup using CA snap-in under all task--> Backup CA--> I select Private key, CArtificate and Certificate Database to be backup When I use this backup, to restore on another new server(I'm moving original Sub CA to another new server) It prompted me a error saying "I can restore using incremental backup"... How should I do a Full CA backup...? Please advise. Thanks Tag: Certificate Service placement on a DC Tag: 91644
  - 20
    - WIRELESS INTRUSION PLEASE HELP ME...MY EX BOYFRIEND HAS SOMEHOW HOOKED UP WITH HIS WIRELESS.........THE COPS WERE EVEN LOOKING FOR A MAN RUNNING WITH A LAPTOP FROM THE EMPTY HOUSE NEXTDOOR & RIGHT AFTER MY DAUGHTER SAID THAT SHE JUST RETURN BACK TO OUR COMP & THE COMPUTER SHUTDOWN AS IF SHE WERE USING THE MOUSE. IS THERE ANY HELP RESOURSES FOR THIS........HE ALREADY VANDALIZED MY TRUCK & CAUSED $17,000 WORTH OF DAMAGE..........AND NOW I AM NOT RECEIVING MY EMAILS.......I DONT KNOW IF THEY ARE GETTING INTERCEPTED Tag: Certificate Service placement on a DC Tag: 91638
  - 21
    - How to Take Back Control of Filetype Associations Here is a new one (for me): on one machine a virus/trojan has changed file associations to point at itself to re-infect the machine each time a known filetype is invoked. The problem is that the virus also locked out the ability for local administrator to even view what those associations are, probably by changing the DACL. How do I take back control and view the associations? -- Will Tag: Certificate Service placement on a DC Tag: 91637
  - 22
    - Install domain certificate in an external machine Hi, do you guys know how to install a domain certificate in a client that login into the domain, using a valid domain credentials (i.e "Mydomain\MyValiduser" ) but his machine is working in his local domain. Thanks, Nelson Tag: Certificate Service placement on a DC Tag: 91629
  - 23
    - Complex Security Hi, I have a client that just install a accounting software, and everybody in the company have to use it but the manager wants to block access to the datafiles that are .DBF and could be open with excel which is largely used in the office, so i managed to block access to the data folders and I created a special user to access the software and give it the rights to the folders, I also created an invisible share to map a drive because the software needs a mapped drive to work. Some people have windows 2000 and everybody else have XP pro, I started testing with 2000 and with the option "run as a different user" in the icon of the shortcut it works, it asks for the username, password and domain of the different user, but today when I started testing with Windows XP, I got the error message "The system cannot find the path specified" I found out that with windows XP as opposed to windows 2000 uses the current session credential to connect to the map drive, is ther a way to avoid that? Thanks Fugitif Tag: Certificate Service placement on a DC Tag: 91628
  - 24
    - Having issues printing from C:\WINNT\TEMP Hi, I'm no network admin but this one is hard to get for me. A lot of computer Windows 2000 SP4 clients when printing from Outlook or Internet are getting blank pages. Now I know that with administrator rights or by adding Domain Users write access on the C:\WINN\Temp folder the problem is solved. However I don't think this is standard behavior to add Domain Users on that folder and we all know that making users part of the admin group is a security issue. This is what the Default Permissions look like on all computers including the ones having the issues. One last note to have is that we did change the Windows Env. variable TEMP value to point to C:\TEMP instead of C:\WINNT\TEMP. This allows a application to run without needing admin rights. Administrator (Computer\Administrators) Creator Owner Power Users (Computers\Power Users System Users (Computers\Users) Tag: Certificate Service placement on a DC Tag: 91627
  - 25
    - Windows XP certificate lost? Hello, I am running Windows XP with all updates. I have 2 disks: C: with the opetational system D: with personal data Some files at D: are encrypted with the NTFS system Yesterday I setup a certificate for Acrobat professional 7 and, by accident, deleted an existing certificate (digital ID) using the Acrobat "Digital ID" management tool (under the menus Advanced -> Security settings -> Digital IDs)... Well... the deleted certificate was not from Acrobat, but from the Windows XP and now I am unable to access the encrypted files. Testing I found Windows XP maybe created a new certificate for encrypt/ decrypt files (and other functions need certificate). I am not sure if the certificate was deleted or only removed from certificates list. Maybe is possible find the disk location of the certificates files and restore it, but I have no idea where the certificates are located in the disk. Some one can help me with this problem? Thank you very much, Sukhoi Tag: Certificate Service placement on a DC Tag: 91625
- Next
  - 1
    - HELP - IE7 doesn't let me get to Windows Update; keeps saying I should add list of websites. reposting this question: Win2003 SP1, IE7. I added the list of websites below. However, I attempt to go to the Windows Update Website and I keep getting annoying message in IE7 saying that I should add the sites below. What's wrong? What it is strange is that under "Security", allowed websites settings I added the complete http://.update.microsoft.com and all other two URL IE7 reports I should have added. Tag: Certificate Service placement on a DC Tag: 91624
  - 2
    - Problem in Certificate Authority Dear Friends, While doing the enrollment for the user certificate of Smart card i am getting for the following error. ********************* Create and submit a request to this CA. Error An unexpected error has occurred: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. ****************** while chekcking int he certificate authority issue status the Enrollment Certificates are expired. please help me as i do not know anything about certificate authority and all my users are facing problem for the logon. best regards Sharad Tag: Certificate Service placement on a DC Tag: 91610
  - 3
    - error message I keep getting a error message for the file name mqqmdisp.exe, and a send error repot pop up after that. When i looked up what this file is, I found that it was a mass dialer program. My antivirus doesnt recognize it as a virus. Is this a virus, and if so how do i get rid of this program. Any help will be appreciated. Thanks Tag: Certificate Service placement on a DC Tag: 91609
  - 4
    - Shares, Named Pipes, and Registry for Anonymous Remote Access I have a trojan I am fighting that replicates by establishing a null connection to IPC$ on any member server that has File & Printer Sharing enabled. It then repeatedly tries to invoke one of several buffer overloads in order to execute code in the SYSTEM context of the targeted machine. I would like to know how can I safely prevent null connections on IPC$. I have all five of the enable/disable settings in GPO security set that forbid anonymous access. Setting those to forbid anonymous is NOT preventing the trojan from successfully establishing the null connection. I can see this quite clearly by following its progress in a sniffer on the attacking machine, and then when the IPC$ connection is established, on the Windows 2003 DC I quite clearly get an eventviewer message that shows ANONYMOUS CONNECTION, and the IP of the eventviewer message matches the attacker's IP. Group Policy for Windows XP/2003 contains the following Security Settings (these names are approximate): Named Pipes that can be accessed anonymously Remote access registry paths Remote access registry paths and subpaths Shares that can be accessed anonymously I have the following questions regarding the above: 1) For a domain controller, is it required that any of these be enabled, and what is the minimum subset of entities that must be exposed? 2) For a member server, same question 3) For Windows 2000 DCs, are most of these just enabled by default and you cannot change the specific settings? 4) When you deselect the checkbox on this group policy, and simply fail to define any entities, then what are the defaults that will be in effect? When I ran RSOP.MSC on one Windows 2003 DC, it had none of these defined even through its local policy and GPO did not select checkboxes for any of these. If the lack of any settings in RSOP.MSC means that nothing is being allowed for anonymous access, then would I get the same result by enabling the checkbox, and simply forcing the list of each GPO setting above to be empty? I'm not clear on what steps if any I should take here to absolutely be sure that there are no anonymous connections allowed to the member server / DC. Any insights on this are appreciated. -- Will Tag: Certificate Service placement on a DC Tag: 91608
  - 5
    - IE7 Critical Update I just went to Critical Update page tonight and expected to see the usual "IE 7 Critical Update" download. I have been putting off downloading IE 7 for a while as I am doing too many other things. However, tonight I 'DO NOT' see the "IE 7 Critical Downlaod" listed any longer. Would anyone know why not? (There was just one download = KB 905474 (Genuine Advantage), which I did download and it then checked my computer and said everything was okay.) Tag: Certificate Service placement on a DC Tag: 91603
  - 6
    - Password Changes remotely thru VPN I have remote employees who connect to our network on a daily basis using VPN. All the workstations that they use are members of our domain. All users are domain users and authenicate against our DC's. We currently have a password policy that requires users to change their password every 90 days. I can always tell when that time frame comes up because at least half of my remote users call stating that they can't connect. Is it possible to prompt a user who is authenicating to the domain to be prompted that their password is going to expire or has expired. What is the best practice that others use to control this in regards to remote users. Thanks Tag: Certificate Service placement on a DC Tag: 91599
  - 7
    - Registry questions We've been running a security application to scan some of our servers and it flagged the below reg keys. Can someone explain what these reg keys are and what they are used for. I've included the error msg flagged with the HKEY_LOCAL_MACHINE reg... Thanks for any help HKEY_USERS\\.Default\\Control Panel\\Desktop\\ScreenSaverIsSecure HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\LSA\\Notification Packages (error msg received.) Data: FPZECLQT RTTSTM SDCEEC scecli; expected data to match regular expression: PAWWFGLT; comment: Palefilt Tag: Certificate Service placement on a DC Tag: 91595
  - 8
    - Purchase of a certificate I am new at setting up security using a certificate. Running 2003 server with exchange2003 on top. I want the Web access to be secure so I am asssuming that I need a cerificate. If I do, is this a one time purchase, or is it an annual thing? Regards Tag: Certificate Service placement on a DC Tag: 91591
  - 9
    - Silent certificate installation Hi guys, does anybody know how to install a certificate on the client machine silently? I already set up the CA authority and it is issuing certificates automatically. When I click to install the certificate I receive 2 messages warning me about the installation of the certificate. Is there any way to install the certificate without user intervention? I mean, a script that I can do, a .NET app, what ever works .... I'll appreciate any clue, cause I don't know where to start. Thanks, Nelson Tag: Certificate Service placement on a DC Tag: 91581
  - 10
    - CERTSRV_DCOM_ACCESS Group missing - suggested KB fix not working 4 Dear all, Have just implemented a W2003 pki for our 3 domain forest, the issuing CA is a w2003 enterprise box, not a dc but installed as part of one of the child domains in the forest under an enterprise admins account. pkiview tells me everything is fine, and domain controllers are auto-enrolling just fine within the child domain hosting the CA, outside in the other child domains they aren't but thats an issue with Cert Publishers membership that i am confident i can resolve by changing the scope of the groups. The problem i have is referenced in http://support.microsoft.com/kb/927066 but the fix does not work in our situation. The fix i am referring to is to run certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG if the CERTSRV_DCOM_ACCESS group is missing from the users container in the ad. Which it is. Running this generates no errors, but does not create the group.... I feel i should also mention that our root domain within the forest was upgraded from w2000 to 2003, but due to an administrative oversight, the schema was updated to R2 before sp1 was applied to the schema master. Not sure if this is related. Essentially i need to have the group so i can add the relevant groups so my users are able to request certificates, at the moment only ent admins can, everyone else receives the following message The wizard cannot be started because of one or more of the following conditions: - There are no trusted certification authorities (CAs) available. - You do not have the permissions to request certificates from the available CAs. - The available CAs issue certificates for which you do not have permissions. Any ideas? Any advice welcomed! Best, Jim Bullock Tag: Certificate Service placement on a DC Tag: 91576
  - 11
    - Client Wireless Set To PEAP But Need Access To Public AP's Also Hi, I have setup a lab using MS IAS and PEAP autnentication for wireless users. This all works great. But the clients that have the group policy assigned for the WIFI policy cant connect to public AP's. Is there any thing I need to do to allow clients to access our secure PEAP wireless network but also be able to connect to public or home AP's. Thanks for any help. Tag: Certificate Service placement on a DC Tag: 91574
  - 12
    - SLL Certificate hi, Does anybody know a URL, where I can buy a secure SSL-certificate for our Windows-Webserver, which one can buy for a low price? The important thing is, that IE7 and other browsers shouldn't prompt the certificate warnings anymore. Thanks for your hint. regards Patrick Tag: Certificate Service placement on a DC Tag: 91570
  - 13
    - Browser Hijack? When I select the Homepage on my internet explorer browser I am immediately taken to the security centre with the following address http://asafetynotice.com/ It advertises a number of security programs you can download (at cost). Though I already have McAffee antivirus/firewall installed which has not detected any problems. It is annoying but it only happens when trying to open the 'Homepage' Would appreciate any ideas. Thanks Tag: Certificate Service placement on a DC Tag: 91567
  - 14
    - "file audit" Hello, We have a Windows 2003 Server which has some folders shared. I have to find a way to know what are doing users whith those files. Most of this files are generated by MS Word, Excel. I tryed to audit those folders but the information is not helping me too much. I would like to know the follwing: - if the files are copied from server to local station and from this to USB flash memory , flopy disk or send by email and so on. - when the user is opening, changing, deleting or closing a file. Can you please tell me if is there a way to do this only with the option from Windows 2003 or do I have to use another software ( is possible please tell me what software should I use)? Tag: Certificate Service placement on a DC Tag: 91565
  - 15
    - Require Info on EAP extension development for windows mobile Hi, We are developing an EAP module for the Windows Mobile 5.0 as per the documentation provided at the MSDN site for the EAP extension development. http://msdn2.microsoft.com/en-gb/library/aa363504.aspx We succeeded in writing the whole EAP module. The whole EAP authentication goes through well with the AAA server(RADIUS) with the extension dll we wrote and we finally receive the outer EAP success, sent as part of the Access-Accept from RADIUS, which indicates the EAP authentication has succeeded. Now as per the documentation in MSDN, we are supposed to pass the MPPE-Send key and MPPE-Recv Key from the RasEapMakeMessage function using the pUserAttributes member of the pEapOutput structure in the final step. These keys are supposed to be used in the EAPOL module in the 4way handshake for the WPA MSK derivation. But its not much clear on how the pUserAttributes is to be filled with these keys. We filled in the pUserAttributes pointer from what we can make out from the following MSDN link in the Remarks section at http://msdn2.microsoft.com/en-gb/library/aa363518.aspx . and another section that appears in the EAP Host documentation for Windows Vista and XP on how MPPE keys are to be handled at http://msdn2.microsoft.com/en-us/library/aa363636.aspx, which we think might also be relevant for the EAP extension development. But they don't seem to work. We tried a lot of combinations but nothing seems to work. When we sniffed/traced on Access Point's logs the supplicant doesn't seem to respond to the EAPOL key request at all as part of the 4 way handshake for the WPA key(MSK) generation. There isin't much help at the MSDN apart from the above. The following is the code piece on how we filled in the fields, can anyone check if the code and tell what is wrong with this and the correct way of doing it The excerpts from the code is as follows: typedef unsigned char u8; struct vsa { u8 attr_type; u8 length; u8 salt[2]; u8 lenofkey; u8 value[32]; u8 padding[15]; }; struct vsa mppe_send_key, mppe_recv_key; char *pos = NULL; // 1-MPPE-Send Key, 1-MPPE-Recv Key, 1-raatMinimum(for termination) lenofuserattr = 3 * sizeof(RAS_AUTH_ATTRIBUTE); pEapOutput->pUserAttributes = (RAS_AUTH_ATTRIBUTE *) malloc(lenofuserattr); pos = (u8 *) pEapOutput->pUserAttributes; memset(pos, 0, lenofuserattr); /* As per MSDN 52 for the sub-attribute AVP which would hold the MPPE keys 4 for Vendor-Id(311 for Microsoft) */ lenofvalue = 52 + 4; //MPPE-RECV-KEY pEapOutput->pUserAttributes[0].raaType = (raatVendorSpecific); //ras auth attribute type (VSA) pEapOutput->pUserAttributes[0].dwLength = (lenofvalue); pEapOutput->pUserAttributes[0].Value = (u8 *) malloc( sizeof(u8) * (lenofvalue) ); pos = (u8 *) pEapOutput->pUserAttributes[0].Value; memset(pos, 0, lenofvalue); vid= ntohl(311); memcpy(pos, &vid, 4); pos += 4; mppe_recv_key.attr_type = 17;//Type MPPE-Recv-Key mppe_recv_key.length = 52; //Total AVP length mppe_recv_key.salt[0] = 0x00; mppe_recv_key.salt[1] = 0x00; mppe_recv_key.lenofkey = 32; // Key length only // The second 32 bits of the buffer 'mppe_keys' is the MPPE-Recv key memcpy(mppe_recv_key.value, mppe_keys + 32, 32);//MPPE-Recv Key memset(mppe_recv_key.padding, 0, 15); //padding memcpy(pos, &mppe_recv_key, sizeof(struct vsa)); //sizeof(struct vsa) is equal to 52 //MPPE-SEND-KEY pEapOutput->pUserAttributes[1].raaType = (raatVendorSpecific); //ras auth attribute type (VSA) pEapOutput->pUserAttributes[1].dwLength = (lenofvalue);//4 - Vendor- Id pEapOutput->pUserAttributes[1].Value = (u8 *) malloc( sizeof(u8) * (lenofvalue)); pos = (u8 *) pEapOutput->pUserAttributes[1].Value; memset(pos, 0, lenofvalue); vid= ntohl(311); memcpy(pos, &vid, 4); pos += 4; mppe_send_key.attr_type = 16; //Type MPPE-Send-Key mppe_send_key.length = 52; //Total AVP length mppe_send_key.salt[0] = 0x00; mppe_send_key.salt[1] = 0x00; mppe_send_key.lenofkey = 32; // Key length only // The first 32 bits of the buffer 'mppe_keys' is the MPPE-Send key memcpy(mppe_send_key.value, mppe_keys, 32); //MPPE-Send-Key memset(mppe_send_key.padding, 0, 15); // Padding memcpy(pos, &mppe_send_key, 52); //Terminate with raat Minimum pEapOutput->pUserAttributes[2].raaType = (raatMinimum); pEapOutput->pUserAttributes[2].dwLength = (0); pEapOutput->pUserAttributes[2].Value = NULL; Thanks, Vijay Tag: Certificate Service placement on a DC Tag: 91564
  - 16
    - Browser being hijacked? After reading some book reviews I I thought I'd make a few purchases at www.amazon.com. But every time I type in amazon.com into my browser I get sent to this http://www.amazon.com/gp/aw/h.html/103-0672385-5251043 It happens on both of my PCs and with firefox and explorer. I am running Windows XP SP2, with spyware doctor and antivir and they don't see to find any problem. Does anyone else have this problem? Best, Rob Tag: Certificate Service placement on a DC Tag: 91563
  - 17
    - Windows XP Home Edition Password My friends daughter set a password on there home pc and nopw can't remember it. Anyway to unlock it? Tag: Certificate Service placement on a DC Tag: 91558
  - 18
    - Annoying "Restricted Sites" behavior, IE 7 From a certainServer, I attempt to go to www.microsoft.com/security. I get there just fine, but when I click on "Windows Update" I notice a 'prohibited' signal on the top of the IE 7 page. From there I can't access Windows Update. What it is strange is that under "Security" settings I added the complete http://update.microsoft.com/windowsupdate/v6/default.aspx and also http://.update.microsoft.com* However the problem persists. What am I missing? How can I browse to the security update sites without restrictions? Tag: Certificate Service placement on a DC Tag: 91556
  - 19
    - A twist to "Logon to domain" Hi all, just scanned the postings and i'm a little suprised. There seams to be no way, to make a user logon/authenticate at a domain WITHOUT the user making his username AND PASSWORD available to the application initiating the logon/ authentication process.... Is that right? I'm refering to CredUIPromptForCredentials function which "publishes" the password of the application the invoking it. Any hint how to initiate the authentication process in a way which does not make the password readable to the invoking application? I really hope i'm just missing something, and it's not by design.... TIA br Radek Tag: Certificate Service placement on a DC Tag: 91555
  - 20
    - Password policie Hello, Is it possible that we have two password policies in one domain. Â¿Can I configure this GPO at site level? Thank you. Tag: Certificate Service placement on a DC Tag: 91549
  - 21
    - public xp media edition I maintain several laptops at our local library. With the Media Center XP 2005 I can't seem to set up limited user accounts. I just want an admin account for me and the librarians and a limited account that doesn't allow any programs to be added or altered. I am pretty computer savvy but not a programmer or expert. I also need to do this on two XP Home laptops. Thank you, Carol M Tag: Certificate Service placement on a DC Tag: 91547
  - 22
    - Group policy to prevent users to safe password Is there a group policy setting to prevent users to check the options for windows to safe passwords? Tag: Certificate Service placement on a DC Tag: 91545
  - 23
    - Waking up from hibernate If my computer hibernates, I move the mouse, or if that doesn't wake it up, I hit the power button. The "User Screen" opens to allow me to chose which user (me or my wife). It also lists the number of programs running, AND also states that i have XXX new mail messages. I have to assume that this is refering to mail in hotmail and not my actual e-mail account. Either way, this must mean that Windows is going to Hotmail with out my permission and checking for mail even though I didn't request this. To me this is an invasion. If I want to check for mail on Hotmail, I'll log in and look. Microsoft has no business checking to see if I have mail. It was quite a while back that I opened the hotmail account, but I don't recall giving permission for this invasion. I am forced to sign up for hotmail to allow access to this site, where does Microsoft get off checking my mail when I'm away from my computer? Maybe I did agree somewhere, we all know how they hide things in their terms of service/ privacy policies, and you have to accept to allow you to continue, just like this page, accept or Poat is grayed out. But this still isn't right. Tag: Certificate Service placement on a DC Tag: 91541
  - 24
    - shared files not accessible I have two computers on the network and they are both running Windows XP. The problem is with one of the computers on the network. I can access shared files on one computer. When I try to access any of the shared files and connect to the other computer I get the following error: PC#1 is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have access permissions. please help!!! Tag: Certificate Service placement on a DC Tag: 91539
  - 25
    - How to disable The Plug-and-play for new USB storage devises ? I manage to disable old USB storage devices and new devices. When there is a new storage devices connected the PnP open the options That enables the operation to browse the HD to locate the drivers. Is there any option to disable all these dialogs? My application does not allow the user to access the HD in any way. Thanks Tag: Certificate Service placement on a DC Tag: 91538

Hello

We are planning for a new domain and Cert. Services placement question
appeared.
What are pros and cons about placing it on a DC (Windows 2003 Server R2)?

Can't find much info on this in MS whitepapers etc.
It is only clear that all Domain Admins group will have access to CA, which
may be not absolutely desirable.

Thanks,
Gera
BDC

Top

Re: Certificate Service placement on a DC by Brian

Brian
Tue Feb 27 18:52:55 CST 2007

In general, it is a bad idea. Once you install Certificate Services, you
cannot change the computer name, you cannot change the domain
membership. Typically, people want to move it off of the DC after a few
years pass.
I would never recommend it.
Brian

In article <O3cv2#nWHHA.3332@TK2MSFTNGP04.phx.gbl>, gera@#$lukrecija.lt
says...
> Hello
>
> We are planning for a new domain and Cert. Services placement question
> appeared.
> What are pros and cons about placing it on a DC (Windows 2003 Server R2)?
>
> Can't find much info on this in MS whitepapers etc.
> It is only clear that all Domain Admins group will have access to CA, which
> may be not absolutely desirable.
>
>
> Thanks,
> Gera
> BDC
>
>
>

Top