Trouble shooting a disease begins with the built in tools that give administrators a detailed view into
the current conditions of ADC s role services.
The following list describes a few tools that you can use cert snap in use this snap in to view and
manage certificates two hours for a computer user or service because I view DOD MSE use this console
to monitor multiple C CRL and area locations and to manage ADC as objects that are published to aided
years certification authority council.
Use this console to administer a C and to revoke and enroll a certificate their certification authority.
Council also allows you to manage the certificate templates that are available on a C the next tool
is sort to your teal dot the exit.
Use this command line tool to display C configuration information to configure ADC s and to back up
and restore C components and to verify certificates key bearer or sound certificate change certificate
templates snapping using SNAP in to analyze and manage the certificate templates in ADR sound to configure
their permissions and other worry parvo.
Powerful tool is Windows power Shell of course you can use only ADC s deployment and ADC as administration
and pick UI modules in Windows power shell as their replacement or complement to the tools listed above.
By taking advantage of Windows power shell module functionality you can rights groups to automatically
test and verify your ADC as configuration and another tool is the group policy management council and
Jabil result don't exceed tools they can be help and they can help you verify the correct application
of group policy so objects and with them in which configure auto enrolment or other PGI related settings.
Now let's review the Common ADC s issues the following list describes common ADC US issues that you
can might that you might encounter users saw computers do not automatically enroll for certificates
as expected and the reasons could be because you enable auto enrolment through group policy and you
should verify that the GPO is that enable auto enrolment for users and computers are a.
Auto enrolment correctly and that the user a computer is not in an in an organizational unit where a
policy inheritance has been blocked or overridden by another GPO.
Both the user and computer must be enabled separately although both certain can reside in the same GPO
then you should reverse verify that a disease is published is published in the certificate template
to an enterprise C that can be accessed by the computer or user.
Then you should verify that the computer or user have the request certificates permission on the CIA
and to the alternate route permission on the certificate template in question and finally you should
verify that the requested certificate template does not require information that ADT s cannot supply
automatically and other common issue is that you cannot configure auto enrolment permissions on a template
for you to configure auto enrolment against a certificate the template must be version to or later and
you can only add version to templates to a C that is running Windows Server 2000 aid enterprise or later
next one is the Enterprise C option is unavailable.
This occurs when a user who is not a member of the enterprise segments or domain admins group installs
AC as such.
The C must not install as an enterprise c.
In this case the enterprise C option is unavailable and information about the C can not automatically
published to aid it is the next issue.
You receive an error when accessing C weapon Roman pages.
This secures while accessing C pages.
In this case you should ensure that the user is a member of the administrator or a sound or power user
group on the client computer.
The next issue is that the enrollment agent is a restricted.
This occurs when an enrollment agent can not enroll on behalf of a user for a specific certificate template.
This might a cure because of the restrictions that were configure tell the enrollment agent or the lack
of enrollment permissions on the certificate template some words about troubleshoot and will addition
issue all certificates have a well validity period after all the validity period expires.
The certificate is no longer an accessible credential glam computer computers might not be able to connect
to resources that require a certificate even a certificate validation problem secure ADC s services
can stop or fail to run if problems solve for availability validity and chain validation for the C certificate
a cure you can use PGI view tool to verify that the EIA and CRL said applications and certificates are
well it.
Additionally you can use the C is near being to install new certificates next up we'll be talking about
renewing as C certificate.