MS CA 2003 ENT SubjectTemplate

TheMSsForum.com: The Microsoft Software Forum

The MSS Forum ‹ Security
- Archive
  - Biz
  - MCSE
  - CRM
  - Drivers
  - Framework
  - ADO
  - ASP
  - Compact
  - Forms
  - Dotnet
  - C#
  - VB
  - FontpageGen
  - Excel
  - WorkSheet
  - Exchange
  - Setup
  - Fox
  - Fontpage
  - ASP
  - IIS
  - Entourage
  - Money
  - Messanger
  - PocketPC
  - Powerpoint
  - Project
  - Publisher
  - Excel
  - VB
  - Security
  - Portal
  - Services
  - SQLServerDev
  - SVCS
  - SQLServer
  - VB
  - VC
  - MFC
  - ExcelGen

- Previous
  - 1
    - Give a user rights to change other user's password I need to build a user that is enabled to change other users password for use of a custom applicazion we are writing. Obviously, i would like these user the have very little privileges besides the required one. We have a Windows Server 2003 Active Directory enviroment. Any suggestions? thx Tag: MS CA 2003 ENT SubjectTemplate Tag: 97856
  - 2
    - WM5 and 802.1X Hello, I have a private CA used for WLAN authentication. My network has the following: a.. There is an existing Wireless infrastructure with several access points. a.. A Windows PKI infrastructure is already in place. a.. The certificate Authority does not use standard templates. a.. XP Notebooks are already running on WEP, EAP-TLS for authentication to the Wireless network. a.. They enroll the certificates through Windows group policy. a.. Microsoft's IAS is used for the Radius authentication, and is connected to the AD with the user accounts. Along with our Windows XP and 2000 systems we have several Windows Mobile 5 barcode scanners. I'd like to get these devices using the 802.1x WLAN security. I understand that I will have to manually install the certificate using a third party installer. What are some examples of good third party installers for this step? I would like AD to use a machine or computer certificate to authenticate a barcode scanner. Is this possible? If I must use personal certificates and authenticate to AD via the RADIUS server what is the best way to setup the user accounts? Several users will be using the barcode scanners and I do not want to assign scanners to users...they will just grab one from a pool that is available. I do want to be able to track connections and network changes back to a particular device/user. What is a good way to accomplish this? If anyone has any documentation or web links that could help with any of these questions it would be a huge help. Thanks in advance! Randy Tag: MS CA 2003 ENT SubjectTemplate Tag: 97847
  - 3
    - Certificate Services - Web Enrollment Error Hi all, I have a problem configuring my lab with this scenario: - Domain A - Domain AA as child of Domain A - Domain AB as child of Domain A - The users are in the domain AB - The computer, service accout, CA are in the domain AA - The CA is an Enterprise CA - The Web Enrollment server is not installed on the same CA server (web enrollment server is in the domain AA) - The Web Enrollment server is configured to use "Windows Integrated Authentication" I followed all the steps described in this link http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/webenroll.mspx (configuring the web enrollment proxy for delegation). The users are the priviliges to read/enroll/autoenroll the certificate template. When I try to (auto)enroll a certificate using certsrv page from the Web Enrollment server I have this error: The RPC Server is unavailable. 0x800706ba Any kind of help will be greatly appreciated. Thanks. Sektor Tag: MS CA 2003 ENT SubjectTemplate Tag: 97843
  - 4
    - Error with Microsoft ForeFront Client Security Hi, I have this error when I try to deploy policy on Microsoft ForeFront Client Security: Microsoft Forefront Client Security: ========================= The policy cannont be deployed. Futher details: Unable to create new group policy object. The specified domain either does not exist or could not be contacted. (Exeption from HRESULT: 0x8007054B) Could you help me? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97842
  - 5
    - Please help us with a fraud situation Please help us with a fraud situation We had some identity thefts situations with our credit cards and Bank accounts. People using our credit cards and writing checks against our account. How can I set up a really secure internet connection in my home ? I use a Windows XP - wireless laptop to access the internet I have in my home. We use Comcast cable. We have a WPA secure internet. We use a Netgear Rangemax MIMO and the Comcast modem. Somehow some people have managed to get both our credit card numbers and bank account numbers and even driving license number. I use this internet to access all our bank accounts etc. Because of the fraud that occurred, we want to make sure that we have a really secure internet connection. What additional hardware, software etc do I need, if any ? Since I am not a techie, pls help me with as much detail as possible. Thanks in advance for your help, Irfan Smith Tag: MS CA 2003 ENT SubjectTemplate Tag: 97840
  - 6
    - h4150 ipaq wireless card to a netgear router I'm unable to connect using the ipaq wireless card to a netgear router running wpa-psk encrytion. If I take encrytion off the ipaq and the router and can connect wireless to the internet. Any Help would be appreciated. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97839
  - 7
    - trojan horse I hope you can help. My laptop has been operating slowly recently, freezing ofgten. Even though my virus protection is up to date, I ran an on-line scan from another virus protection company. Their scan showed I had a trojan horse is the file "vgraph.dll". Is this a necessary file? Can I just delete it? I don't know if this is responsible for the problems but when its acting up, and I open up task manager, the CPU usage is almost 100% with the highest amount in "iexplore.exe". Any help would be appreciated, thanks! Tag: MS CA 2003 ENT SubjectTemplate Tag: 97835
  - 8
    - Moving newly issued Certificate Hello: I am testing certificates download from a standalone CA Win2k3 server. When the certificate is downloaded and installed on the local client machine (when the certificate was requested, did submit the request for storing the certificate under Computer Account/store), it installs the Trusted Root certificate by default at Certificates (Local Computer)-->Intermediate Certificate Authority-->Certificates since the certificates are issued by a subordinate CA. I will have to manually move the Trusted Root Certificate over to Certificates (Local Computer)-->Trusted Root Certification Authority-->Certificates bin to restore the certificate chain (Root-->Intermediate CA-->the local machine). I am wondering whether I can automate this using one of the command line utitilities? If so, please let me know. Thanks. Regards, Victor Tag: MS CA 2003 ENT SubjectTemplate Tag: 97834
  - 9
    - "Microsoft Update" offers 898461 for XP SP3 Hi @ll, "Microsoft Update" just offered the update 898461 for my (german) XP SP3 system. According to MSKB 946480 this update has been included in SP3; but apparently this is wrong! Unfortunately this patch REALLY gets installed and writes OUTDATED files to my system: | C:\>dir %windir%\System32\Preinstall\WinSE\wxp_x86_0407_v1 | Datenträger in Laufwerk C: ist WINDOWS | Volumeseriennummer: 2C36-0AF4 | | Verzeichnis von C:\WINDOWS\System32\Preinstall\WinSE\wxp_x86_0407_v1 | | 27.05.2008 20:38 <DIR> . | 27.05.2008 20:38 <DIR> .. | 25.02.2005 05:34 15.584 spmsg.dll.ref | 25.02.2005 05:34 213.216 spuninst.exe.ref | 25.02.2005 05:34 22.752 spupdsvc.exe.ref | 25.02.2005 05:34 22.240 spcustom.dll.ref | 25.02.2005 05:34 727.776 update.exe.ref | 25.02.2005 05:34 378.080 updspapi.dll.ref | 6 Datei(en) 1.379.648 Bytes | 2 Verzeichnis(se), 10.514.202.624 Bytes frei | | C:\>filever %windir%\System32\Preinstall\WinSE\wxp_x86_0407_v1 | c:\windows\system32\preinstall\winse\wxp_x86_0407_v1\*.* | ----- W32i DLL DEU 6.1.22.4 shp 15,584 02-25-2005 spmsg.dll.ref | ----- W32i APP DEU 6.1.22.4 shp 213,216 02-25-2005 spuninst.exe.ref | ----- W32i APP ENU 6.1.22.4 shp 22,752 02-25-2005 spupdsvc.exe.ref | ----- W32i APP ENU 6.1.22.4 shp 22,240 02-25-2005 spcustom.dll.ref | ----- W32i APP DEU 6.1.22.4 shp 727,776 02-25-2005 update.exe.ref | ----- W32i DLL DEU 6.1.22.4 shp 378,080 02-25-2005 updspapi.dll.ref The current version of all these files, as delivered with XP SP3 for example, are but 6.3.13.0, their timestamps are 2007-08-10 20:4[45]! WHEN WILL MICROSOFT START TO LIVE TRUSTWORTHY COMPUTING? not amused Stefan Kanthak Tag: MS CA 2003 ENT SubjectTemplate Tag: 97833
  - 10
    - need firewall for windows 98se Can you tell me which firewall still works with Windows 98se. Thank you. Ginny Tag: MS CA 2003 ENT SubjectTemplate Tag: 97831
  - 11
    - Program Signing Programming questions. Is there a way to insert some information into an EXE file which was signed by SignTool without affecting the file signature? I want to add a track id to the EXE, and while running the EXE it will use this Track ID to notify me of the distribution of this EXE. Can anyone has an Idea how this can be achived? without creating new packages or other stuff, just insert info into some free unsigned structures in the EXE? Thanks in advance, Joe Tag: MS CA 2003 ENT SubjectTemplate Tag: 97830
  - 12
    - Virus - Notepad exits by itself - C:\WINDOWS\system32\advpackf.exe My PC is infected with a virus. It is popping up with "Your system is probably infected with latest version of Spyware.cyberlog.X. When I checked with Process explorer; it showed that one process is running "C:\WINDOWS\system32\advpackf.exe" which has written many entries in Regedit. I have killed the process and deleted all the entries in registry editor, I could find. Strange thing is when I search on C:\WINDOWS\system32\ for the file advpackf.exe even after unhiding all the files. It fails to show up, however if I run the C:\WINDOWS\system32\advpackf.exe from the Run menu, it again starts all the popups and tries to change the start up page of browser. After this virus, I am unable to start Notepad.exe, after starting Notepad immediately exits by itself. Please advice. -- SS Tag: MS CA 2003 ENT SubjectTemplate Tag: 97827
  - 13
    - Verify Method of the SignedData Object Hi, I have digitially signed a file. Now i would want to verify the digital signature of the file. I would like to know using which encoding should i convert the File stream to string? IS there any API which retrieves the digital signature from the file and content of the file (Saggregate)? -Debugger Tag: MS CA 2003 ENT SubjectTemplate Tag: 97824
  - 14
    - IPSec Monitor's Main Mode window Hello: I have a WinXP client accessing a Win2k3 server. All latest updates and service pack applied. IPSec policy is assigned to both the client and the server. No problem is getting secured connection between the peers. Once the connection is established, I open up the IPSec Monitor, go to Main Mode-->Security Association and select the Propertes of the secured session. Under the field Policy Name, it shows "73 (Default)." I have seen this number changing. The IPSec Policy that I have assigned has a different name which uses "Request Security" setting under "Filter Action" tab inside the "Properties" of IPSec policy. Wondering from where this number information coming from? Is it possible to change that Policy Name changed to the real name of the Policy that is showing up under "IP Security Policies on Local Computer?" Your quick response on this will be greatly appreciated. Thanks. Regards, Victor Tag: MS CA 2003 ENT SubjectTemplate Tag: 97820
  - 15
    - Last accessed date on file properties This is my first post so here goes. Under the properties of "local" files, the last access date is showing up with today's date and time when they are known not to have been open today. Is the event of checking the properties on files considered accessing the files? Microsoft's website indicates that the date and time is only changed with the act of opening the files. Could this bea sign of a security breach? I have been able to replicate this on many machines running xp sp2. Any help would be appreciated Tag: MS CA 2003 ENT SubjectTemplate Tag: 97818
  - 16
    - Password Max Age Anyone know why the previous recommendation was 42 days and not a round number? And now we have "default" 42 days and "recommended" 90 days...why did that change from 42 to 90 days? Thanks Tag: MS CA 2003 ENT SubjectTemplate Tag: 97815
  - 17
    - Website proofing Hello If I have a suspicious file, I usually send it to "virustotal". My question is there any website similar to virustotal that will check for website links? I received this address in my mail "www dot high98 dot com" and would lke to check if ok. Thx you! Mingo Tag: MS CA 2003 ENT SubjectTemplate Tag: 97812
  - 18
    - Need help & support regarding MBSA 2.1 beta 2 I am trying to run a scan with MBSA 2.1, but it encounters an error as soon as it begins. Here is the log of the scan: Security assessment: Incomplete Scan Computer name: MSHOME\YOUR-9020FCA106 IP address: 192.168.0.101 Security report name: MSHOME - YOUR-9020FCA106 (5-22-2008 2-11 PM) Scan date: 5/22/2008 2:11 PM Scanned with MBSA version: 2.1.2030.0 Catalog synchronization date: Security update catalog: Windows Server Update Services Security Updates Scan Results Issue: Security Updates Score: Unable to scan Result: Cannot scan because target computer is not assigned to a Update Services server. Operating System Scan Results Administrative Vulnerabilities Issue: Local Account Password Test Score: Check passed Result: No user accounts have simple passwords. Detail: | User | Weak Password | Locked Out | Disabled | | HelpAssistant | - | - | Disabled | | SUPPORT_388945a0 | - | - | Disabled | | ASPNET | - | - | - | | Administrator | - | - | - | | Guest | - | - | - | | miguel mesa | - | - | - | Issue: File System Score: Check passed Result: All hard drives (1) are using the NTFS file system. Detail: | Drive Letter | File System | | C: | NTFS | Issue: Password Expiration Score: Check not performed Result: Check is skipped on Windows XP Home Edition computers. Issue: Guest Account Score: Check passed Result: The Guest account is not disabled on this computer. Issue: Autologon Score: Check not performed Result: Check is skipped on Windows XP Home Edition computers. Issue: Restrict Anonymous Score: Check passed Result: Computer is properly restricting anonymous access. Issue: Administrators Score: Check passed Result: No more than 2 Administrators were found on this computer. Detail: | User | | Administrator | | miguel mesa | Issue: Windows Firewall Score: Best practice Result: Windows Firewall is managed through Group Policy on this computer. Windows Firewall is disabled and has exceptions configured. Detail: | Connection Name | Firewall | Exceptions | | Incoming Connections | N/A | N/A | | Internet Connection | N/A | N/A | | All Connections | Off | Ports, Programs, Services | | Broadband Connection | Off* | Ports*, Programs*, Services* | | Local Area Connection | Off* | Ports*, Programs*, Services* | | MSN | Off* | Ports*, Programs*, Services* | | Wireless Network Connection 3 | Off* | Ports*, Programs*, Services* | Issue: Automatic Updates Score: Check passed Result: Updates are automatically downloaded and installed on this computer. Issue: Incomplete Updates Score: Best practice Result: No incomplete software update installations were found. Additional System Information Issue: Windows Version Score: Best practice Result: Computer is running Windows 2000 or greater. Issue: Auditing Score: Best practice Result: Check is skipped on Windows XP Home Edition computers. Issue: Shares Score: Best practice Result: 1 share(s) are present on your computer. Detail: | Share | Directory | Share ACL | Directory ACL | | print$ | C:\WINDOWS\system32\spool\drivers | Everyone - R, Administrators - F | Everyone - F | Issue: Services Score: Best practice Result: No potentially unnecessary services were found. Internet Information Services (IIS) Scan Results IIS is not running on this computer. SQL Server Scan Results Instance MSSMLBIZ Administrative Vulnerabilities Issue: SQL Server/MSDE Security Mode Score: Check passed Result: SQL Server and/or MSDE authentication mode is set to Windows Only. Issue: Exposed SQL Server/MSDE Password Score: Check passed Result: The 'sa' password and SQL service account password are not exposed in text files. Issue: CmdExec role Score: Check passed Result: CmdExec is restricted to sysadmin only. Issue: Registry Permissions Score: Check passed Result: The Everyone group does not have more than Read access to the SQL Server and/or MSDE registry keys. Issue: Folder Permissions Score: Check failed (critical) Result: Permissions on the SQL Server and/or MSDE installation folders are not set properly. Detail: | Instance | Folder | User | | MSSMLBIZ | c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn | BUILTIN\Users | | MSSMLBIZ | c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn | YOUR-9020FCA106\SQLServer2005MSSQLUser$YOUR-9020FCA106$MSSMLBIZ | | MSSMLBIZ | c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn | \CREATOR OWNER | | MSSMLBIZ | c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data | YOUR-9020FCA106\SQLServer2005MSSQLUser$YOUR-9020FCA106$MSSMLBIZ | | MSSMLBIZ | c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data | YOUR-9020FCA106\SQLServer2005MSSQLUser$YOUR-9020FCA106$MSSMLBIZ | | MSSMLBIZ | c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Data | \CREATOR OWNER | Issue: Sysadmin role members Score: Check not performed Result: Could not perform this check because SQL Server and/or MSDE was not running. Issue: Guest Account Score: Check not performed Result: Could not perform this check because SQL Server and/or MSDE was not running. Issue: Sysadmins Score: Check not performed Result: Could not perform this check because SQL Server and/or MSDE was not running. Issue: SQL Server/MSDE Account Password Test Score: Check not performed Result: The check was skipped because SQL Server and/or MSDE is operating in Windows Only authentication mode. Issue: Service Accounts Score: Check failed (non-critical) Result: SQL Server, SQL Server Agent, MSDE and/or MSDE Agent service accounts should not be members of the local Administrators group or run as LocalSystem. Detail: | Instance | Service | Account | Issue | | MSSMLBIZ | MSSQL$MSSMLBIZ | miguel mesa | Local Administrator account. | Issue: Password Policy Score: Check not performed Result: Could not perform this check because SQL Server and/or MSDE was not running. Issue: Public Permissions Score: Check not performed Result: Could not perform this check because SQL Server and/or MSDE was not running. Issue: SSIS Roles Score: Check not performed Result: Could not perform this check because SQL Server and/or MSDE was not running. Issue: Sysdtslog Score: Check not performed Result: Could not perform this check because SQL Server and/or MSDE was not running. Instance SONY_MEDIAMGR Administrative Vulnerabilities Issue: SQL Server/MSDE Security Mode Score: Check passed Result: SQL Server and/or MSDE authentication mode is set to Windows Only. Issue: Exposed SQL Server/MSDE Password Score: Check passed Result: The 'sa' password and SQL service account password are not exposed in text files. Issue: CmdExec role Score: Check passed Result: CmdExec is restricted to sysadmin only. Issue: Registry Permissions Score: Check passed Result: The Everyone group does not have more than Read access to the SQL Server and/or MSDE registry keys. Issue: Folder Permissions Score: Check passed Result: Permissions on the SQL Server and/or MSDE installation folders are set properly. Issue: Sysadmin role members Score: Best practice Result: BUILTIN\Administrators group should not be part of sysadmin role. Issue: Guest Account Score: Check passed Result: The Guest account is not enabled in any of the databases. Issue: Sysadmins Score: Check failed (non-critical) Result: More than 2 members of sysadmin role are present. Issue: SQL Server/MSDE Account Password Test Score: Check not performed Result: The check was skipped because SQL Server and/or MSDE is operating in Windows Only authentication mode. Issue: Service Accounts Score: Best practice Result: SQL Server, SQL Server Agent, MSDE and/or MSDE Agent service accounts should not be members of the local Administrators group or run as LocalSystem. Detail: | Instance | Service | Account | Issue | | SONY_MEDIAMGR | MSSQL$SONY_MEDIAMGR | SYSTEM | LocalSystem account. | | SONY_MEDIAMGR | SQLAgent$SONY_MEDIAMGR | SYSTEM | LocalSystem account. | Desktop Application Scan Results Administrative Vulnerabilities Issue: IE Zones Score: Check passed Result: Internet Explorer zones have secure settings for all users. Issue: Macro Security Score: Check not performed Result: No Microsoft Office products are installed Any kind of help will be greatly appreciated. Thanks Tag: MS CA 2003 ENT SubjectTemplate Tag: 97803
  - 19
    - NTFS Permissions It seems to me that NT & XP has a command at DOS / CMD that will reset all NTFS permissions. Do you remeber what that is? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97801
  - 20
    - Chassis intrusion detected I am using XP PRO Meadia Center Edition. I recently added a harddrive. Now i am getting this,Chassis intrusion detected. This typically does NOT indicate a hardware failure. 1. Contact your Help Desk if you did not personally open your chassis. 2. Enter System Setup & Set Chassis Intrusion to 'Clear' I have went to setup and it askes me for a (setup password) but my password dosn't work. Yes i am the administrator and in fact the only user of this computor how do i get in to reset the password or reset to clear or reset to no password required? -- timtim Tag: MS CA 2003 ENT SubjectTemplate Tag: 97800
  - 21
    - Auditing / File Security Can anyone tell if it is possible (and if yes how?) to log or audit file access. This is a large domain running 2003 AD with a mix of NT / 2000 servers. The simple and basic scenario is as an example HR is a group all with access to Folder X. Within Folder X there are some basic spreadsheets that all these users can access. One of these users has either accidentally or intentionally deleted one of these files. Retreiving the file from tape took all of 3 minutes, but the powers that be would like to know which user it was that deleted it. I have looked through the event viewer security logs and cannot seem to find any reference to that file being accessed or deleted. Is there an auditing feature on the DC that will enable me to check for such things? If ther eis which is it, and what would it look like so I can recognize it in the event viewer. I mean would the event specifically name the file that was deleted? USER A deleted FILE X? Any pointers tips or methods others use would be great. It seems locking stuff down so that a small number of users are the only ones with access to it, isn't enough these days. HELP! :) Tag: MS CA 2003 ENT SubjectTemplate Tag: 97799
  - 22
    - CA root certificate Hi to all. This is my first post and my first step to the PKI knowledge. Someone have asked me if there is a way to make the Root Certificate not exportable so only the one who have installed this certificate in the machine can access via PEAP to the wifi network and in the same time the user cannot pass this certificate to another PC. A kind of security enanchement. Ok...i think i have the answer and it's NO, but to be honest I'm too new to this topic and I wont to be sure. Thank for your intrest and sorry for my bad english Tag: MS CA 2003 ENT SubjectTemplate Tag: 97798
  - 23
    - PKI - Manual Enroll - Auto Renewal - Possible? How do you configure a certificate template for Manual enrolment and Auto renewal? For example: I have a web server called â??WINSERVER1â??. It hosts a website called â??coolwebsite.localâ?? I request an SSL from the internal CA called coolwebsite.local. I want that certificate to automatically renew when it expires. Obviously this has to be a manual enrolment as the server would not know how to request some random website name in a certificate. This is what I have configured: I have an AD Integrated Enterprise issuing CA. A version 2 certificate template has been created for computer authentication. Template settings are as follows: Subject Name Tab -Supply in the request (followed by a description. The sentence of interest is â??Autoenrollment is not allowed if you choose this option) Issuance Requirements Tab -Require the following for enrolment: CA certificate manager approval -Require the following for reenrolment: Valid existing certificate Security Tab -AD group allowing Read Enroll and Autoenroll A server is added to the AD group that was configured on the Template permissions tab. A GPO has been created allowing the server to autoenroll and renew. A certificate was requested via the web interface http://caname/certsrv using this template and approved via the Certificate Authorities mmc. The server then had a certificate with a validity of 1 year. My expectation was that it would auto renew the certificate when it was due to expire â?? using the GPO, Template security, and â??Valid existing certificateâ?? issuance requirement. This has not happened. Have I configured something incorrectly? Or Is it not possible to have manually enrolled and automatically renewed? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97790
  - 24
    - Internet Access fails after VPN established Hi, I have a VPN connection set up using Internet Explorer-Tools-Internet Options-Connections. When at home, I first connect to the internet thro an ADSL Router. Am able to access internet. Now I connect to the VPN. I can access remote LAN without any probs. Can RDC/VNC/Explore any of the IP addresses in Remote LAN. However, I cannot access the Internet as long as the VPN is on. How can I access both the internet and the Remote LAN simultaneously? TIA Kar Tag: MS CA 2003 ENT SubjectTemplate Tag: 97776
  - 25
    - how do I logon to local admin on server 2003 doman Hi all, Had a 2003 server crash. Got it backup but discovered I did not have local password to use to do a chkdsk. My question is now that the server is backup how do I logon as local administrator to test my password. When I log off as domain administrator the drop down box to logon does not have an option to logon as local admin. It only shows my domain. Do I need to restart the server and hit a function key or something? I just wanted to test the local admin password so that next time I need it I will know what it is. Thanks in advance for any help on this. Sher Tag: MS CA 2003 ENT SubjectTemplate Tag: 97759
- Next
  - 1
    - Hotmail Is it just me, or has there been a significant increase in the number of fraudulent phishing type scams on the Hotmail service bulk email folder? dUh...when are they going to do something about it?! I usually would submit these to abuse@hotmail.com or whichever mail service I am using at the time. At Hotmail the complaint gets the auto-response of no action taken. It is almost as if by elimination they are looking for who we don't have an account with... Tag: MS CA 2003 ENT SubjectTemplate Tag: 97752
  - 2
    - Windows Defender- no v2.0? Wont there be a windows defender v2.0? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97748
  - 3
    - rogue local policy I was advised to post here. I have a client who has SBS 2003 r2. On the VP's workstation, he downloaded a cutesy screen saver. Then he removed it. Damage done! He now cant remote into his workstation. Error message is that the local policy wont permit it! I have logged on locally as admin and cant turn off windows firewall (greyed out), which somehow got turned on. Ran all the virus and spyware scans. Nothing. The remote exception is enabled. I think I might have to wipeout his workstation and re-install. Not what I want to do. Any suggestions? Thank You, Corky Tag: MS CA 2003 ENT SubjectTemplate Tag: 97738
  - 4
    - How to Protect Your Credit or Debit Card and Account Number ??? http://the-secured-credit-cards.blogspot.com, To protect your account numbers, be cautious about sharing them, whether purposely or inadvertently. Know where your cards are at all times, and be suspicious of anyone who requests your number over the phone. More resource : http://the-secured-credit-cards.blogspot.com http://the-credit-card-application.blogspot.com Tag: MS CA 2003 ENT SubjectTemplate Tag: 97736
  - 5
    - Getting bounced emails that I did not send. For the past few weeks I have been getting a lot of bounced emails that I did not send. They come to both my address and my wife's. They come in spurts. Today I received about 70 in one hour. Then it stopped. It will probably happen again tomorrow. What is happening. Is there a page where this problem is described? Stan Hilliard Tag: MS CA 2003 ENT SubjectTemplate Tag: 97729
  - 6
    - Dcom Exploit My Avast online scanner keeps flashing up with a Dcom Exploit 88.107.???.???:135 /tcp (the ???.??? keeps changing. 251.156, 115.154 being two of the combinations.) Am I being targeted by someone. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97720
  - 7
    - Virtual PC 2007 (SP1) silently installs vulnerable MSXML6 Hi @ll, one more chapter in the book "How Microsoft lives Trustworthy Computing". NOT! Yesterday the "Virtual PC 2007 Service Pack 1" was published on the Microsoft Download Center. The SETUP.EXE (32 bit) available for download there contains but an outdated and vulnerable MSXML6 (msxml6-KB927977-enu-x86.exe to be precise; notice the ENU, even in the GERMAN SETUP.EXE). This MSXML6 gets installed (in case no newer MSXML6 is already present on the target system) WITHOUT ANY notice even before the first MSI dialog of VPC is displayed, i.e. the users system is altered even if s/he choses to abort the installation (or the installation aborts itself, as is the case on Windows 2000). Where has the QA department been sleeping lately? Stefan PS: "Virtual PC 2007" has the same error too. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97719
  - 8
    - Bravesentry.com has hijacked my home pc! I desperately need help! This virus has hijacked my pc to make it look like a program has installed on my pc and is scanning my pc for viruses. It comes up with I believe fake viruses and tells me to purchase and download this software to remove it. It changed my windows so now I don't have administrative rights to uninstall anything. I looked in task manager, and can't find any bravesentry entry, but not sure what else to look for. I tried safe mode, but still have no admin. access. I tried to restore to an earlier time, but that doesn't help. It has installed not only bravesentry, but other stuff I can see on my desktop. I called Geeksquad and they said I would have to bring it in to have it fixed and cost about $200! I have windows xp, sp2 IE6 Dell 8300 (about 4 yrs old) It also has hijaced my internet. I would like to restor to an earlier image of my pc but I don't know how to do that. Anyone else have any advise on how to get my pc back to normal? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97716
  - 9
    - Problem with WLAN IAS certificate enrollment -Group policy set to allow autoenrollment -IAS/DC's members of new security group -Certifcate template set to allow enroll and autoenroll for newly created security group -Both IAS/DC's have been rebooted since adding to new group -Domain controller certs have been issued to both IAS servers -Selected automatically enroll certs in Certificates MMC. I have done this a few times now over the past four days...certs are not being issues to the IAS servers for WLAN auth. There are no errors in the application log on the IAS servers or the CA server. Any ideas on how to get this cert issued to both IAS servers? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97715
  - 10
    - Token validation is inconsistent Hi, I am having a very wiered problem. I am using kerberos validation. Initially client sents the token to server and sever sends some reply token & demands for next round of validation. And then finally server gives a token that client has to use for further communication with server, handshake complete. This works fine for US AD server, but does not for UK AD server. I am using Windows 2003 server. Please help! Thanks! Tag: MS CA 2003 ENT SubjectTemplate Tag: 97712
  - 11
    - Forefront and System center on the same server. Windows 2008 and SQL 2005 SP2 I want to install Forefront client security, Operations Manager 2007 and Configuration manager 2007 on the same server. Will I encounter problems? How can I avoid them? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97709
  - 12
    - User permission to open Open files in Computer Management Hi All, I would like to add an 'view' access to an user in Computer Management/Shared Folders/Open Files. (Windows 2003 server). When an user open it (Open Files), he get an error message, that he has not permission to view the open file list from windows clients. I have administrator rights, and I have work it. I cannot get Server Operator rights to this user, because he has to view open files or sessions only. Could someone give me help, how to give appropriate right to the user. Thank You, Attila Tag: MS CA 2003 ENT SubjectTemplate Tag: 97708
  - 13
    - Need help with xcals syntax! My problem: I want to grant a user to a folder all accesses except Traverse, Take Ownership and Change Permission. I do not know how to compose command line syntax. ~~~~~~~~~~~~~ There seems to be two XCALS from Microsoft. One is a VBScript xcals.vbs and the other is xcals.exe from 2000 reskit. The two tools do not have exact syntax. However, when I tested xcacls.exe with a folder (xcacls c:\temp\1 /E /T /G guest:EWD), and open Properties Security tab, I get: --------------------------- Security --------------------------- The permissions on x are incorrectly ordered, which may cause some entries to be ineffective. Press OK to continue and sort the permissions correctly, or Cancel to reset the permissions. --------------------------- OK Cancel --------------------------- Tag: MS CA 2003 ENT SubjectTemplate Tag: 97707
  - 14
    - Problems with Forefront installation. Windows 2008 Standard SQL 2005 SP2 Standard When running preinstall check I get this errors: Warning: SQL Reporting Services 2005 SP1 is not installed.---it is installed, services are running and Iâ??m able to access the http://server/Reports website. Next error: Task(Install the Collection Database) The following process failed. Process: C:\Windows\system32\msiexec.exe Exit code: 1603Number of tasks completedâ?¦â?¦. any ideas Tag: MS CA 2003 ENT SubjectTemplate Tag: 97703
  - 15
    - Problem with creating site server signing certificate template Windows 2008 Iâ??m trying to create a certificate by following directions from here: http://technet.microsoft.com/en-s/library/bb694035.aspx#BKMK_siteserver At the section â??Requesting the Site Server Signing Certificate for the Server That Will Run the Configuration Manager 2007 Site Server To request the site server signing certificate: â?? #5 advanced certificate requestâ??there is no template that I made in My steps are: http://server/certsrv Request a certificate, then advanced certificate, then create and submit a request to this CA. When I click on that link, I get â??In order to complete certificate enrollment, the website for the CA must be configured to use HTTPS authentication.â?? I click OK, and then look in the certificate template, and I donâ??tâ?? see it . Plus where on the CA server do I need to enable HTTPS authentication. IIS 7 is different, and Iâ??m not quite sure where is that option. Another thing is that IE has a yellow bar that said that IE prevented ActiveX and is not giving me an option to enable it. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97702
  - 16
    - Does anyone still have Win32Security.dll from gotdotnet? I have a need to set file security in a small app for a customer but have to do it in Visual Studio 2003. So the new security classes in 2.0 are not available to me. I remember I once used a user sample called Win32Security (created Microsoft guys) from gotdotnet. Now gotdotnet is shutdown and moved to MSDN - without all user samples moved to the new site! I wonder if anyone still has Win32Security.dll and can kindly please send me a copy. Thanks. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97697
  - 17
    - Command for changing file security? I'd like to know if there is a command to let me change file security in console window. Thanks. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97682
  - 18
    - How to prevent users from deleting Word/Excel files in a Share? Anyone know how to prevent users from deleting files/folders (Word/Excel files) but still allow them to edit and save them? I setup a test share on a Win2K3 Server. Remove all rights for all users except for the admin group. At the NTFS security tab I grant a group Modify, Read/execute, list, read and write permissions. Then in the advance/special permissions tab I enable the deny delete subfolders and files right. I then create a word doc and it allws me to create it and edit it but the temp file dont get deleted. If an Excel file gets edited and saved we get an error the the folder is marked as read only. So at a high level I wnt to prevent users from deleting MS Office docs but still edit them. I know the users can still open then and delete the contents of the file itself but I can live with that...any suggestions? Thank you, Tag: MS CA 2003 ENT SubjectTemplate Tag: 97681
  - 19
    - impersonation for active directory userid fails Hi, Is there a particular property/permission I need to assign to a userid within active directory so that I can user impersonation? I ran into a situation where one particular userid cannot be impersonated but this program has been successfully doing impersonation for quite some time. The LastError message is Logon failed but when I login manually using the userid on this particular machine it is able to login. This leads me to believe there is a local security setting or an AD setting that is preventing me from impersonating. I hope this email makes sense :-). Thanks in advance. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97676
  - 20
    - I am looking for the classic "Send Keys" program Gurus, I am looking for the classic "Send Keys" program, to work on either Windows XP or Windows Server 2003, but I want to download it from a site which is virus and ad-ware free. Any suggestions? -- Spin Tag: MS CA 2003 ENT SubjectTemplate Tag: 97668
  - 21
    - adware-spyware computer behaves erratic I formated my computer and installed fresh operating system. When I open an internet explorer and browse some adware get installed and my desktop seems to be hijacked some ads gets displayed on my desktop.When I open a browser some unknown sites get opened. Please give me real solution for this and wht i need to do. Anil Tag: MS CA 2003 ENT SubjectTemplate Tag: 97665
  - 22
    - Q: NTFS Encryption Suppose someone wanted to set up a database and the DB starts as a service when the computer is booted. The database directories are encrypted using NTFS encryption. As I understand it, the secret key for the encryption is "protected" using the password of the account who originally encrypted the files (the encryption key is itself encrypted with the user's password). When the DB service is created, the user enters the DB password so that the serrvice can start and can decrypt its files, without the user having to enter the password every time the machine is rebooted. That DB password MUST be stored somewhere on the hard drive, otherwise the encryption key could not be recovered and the files would be unreadable. Now I understand that if you removed the hard drive from the original computer and placed it in a new computer as a secondary drive, if the new computer is also running Windows, you will not be able to recover the DB password and so will not be able to read the DB encrypted files. But, support you placed that drive in a Linux machine. Could you not find the DB password (it MUST be some place on the drive), and with that, decrypt the DB encryption key and get access to the encrypted files? Where is the flaw in my logic? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97662
  - 23
    - Patches installing during shutdown I've had a couple times when I tried to shut down but Windows said it had to install updates and then shutdown. Which it did okay. I'm confused what the setup has to do with this. If you have Automatic Updates on, it could be fully automatic or it could be "Notify but don't install right away." Do these two settings have to do with whether or not it will install during shutdown? If it is fully automatic, you can also set a time, and I think the time selected can cause Windows to update during shutdown. Tag: MS CA 2003 ENT SubjectTemplate Tag: 97655
  - 24
    - Existing untrusted Root CA I have a Win2003 AD domain with an untrusted root CA (it is installed on a DC) that I would like to remove. I have already built a new offline root CA and online enterprise issuing CA in this domain. My DCs and ISA servers (same machines) are not getting the domain controller certificates or ISA certificates. I believe this is because of the existing untrusted certificate already assigned to the computer account in AD but I'm not positive. Both DCs (again ISA as well) are members of the Cert Publishers security group. Do I need to remove the existing CA to get the domain controller certificate from the new issuing CA to install correctly? If so, what are the proper steps in removing the CA? There is only one certificate that is still in use for this CA and it is for a test webserver. Thanks for your help! Randy Smith Tag: MS CA 2003 ENT SubjectTemplate Tag: 97653
  - 25
    - Creating Site Server Signing Certificate Template Windows 2008 Iâ??m trying to create a certificate by following directions from here: http://technet.microsoft.com/en-us/library/bb694035.aspx#BKMK_siteserver Creating and Issuing the Site Server Signing Certificate Template on the Certification Authority On #15, I ran into problem, my server is standard edition; I did an upgrade to enterprise over standard (without reinstalling OS) #15 In the Enable Certificate Templates dialog box, select the new template you have just created, ConfigMgr Site Server Signing Certificate, and then click OK. I donâ??t see the certificate template that I just created even after upgrading to enterprise and redoing the template. Any ideas/suggestions? Tag: MS CA 2003 ENT SubjectTemplate Tag: 97641

Hi all,

I am looking for a way to use a field uid in certificate's subject
name.

Referring to http://technet2.microsoft.com/windowsserver/en/library/526b1a33-1088-4432-9a86-edcd732e38a11033.mspx?mfr=true
it is possible to have some kind of filter in CA. If I am just doing a
certutil -setreg ca\SubjectTemplate +UID the certsvc service will not
start any more. Does anyone know if it is possible (maybe not support
by MS) to allow UID?

Regards,
Lutz

Top

Re: MS CA 2003 ENT SubjectTemplate by Lutz

Lutz
Thu May 29 13:23:47 CDT 2008

On May 29, 5:10=A0am, Lutz <Lutz.MHip...@gmail.com> wrote:
> Hi all,
>
> I am looking for a way to use a field uid in certificate's subject
> name.
>
> Referring tohttp://technet2.microsoft.com/windowsserver/en/library/526b1a3=
3-1088-...
> it is possible to have some kind of filter in CA. If I am just doing a
> certutil -setreg ca\SubjectTemplate +UID the certsvc service will not
> start any more. Does anyone know if it is possible (maybe not support
> by MS) to allow UID?
>
> Regards,
> Lutz

Hi, I found an kb article to meet my requirement kb928016. Its working
nicely.
Ciao, Lutz

Top