Skip to main content

Why XP clients cannot request web enrollment certificates from Windows 2008

By
One of the strong points of what Microsoft has been doing over the years has been to maintain compatibility with software for previous versions of its operating systems. This has worked well for a long time. After all, why would you go through the expense of upgrading all your clients to a new OS if it meant buying completely new software packages. The cost would be to prohibitive. As with all old technology, sometimes the old has to give away completely to the new. Case in point, take a look at what the telegraph did to the Pony Express.

The Web Enrollment on Windows Server 2008 has changed. On a Vista machine, it will look as it always has. On XP, it simply will not work. The Server 2003 enrollment control, XEnroll.dll has been replaced by CertEnroll.dll in Server 2008. The enrollment agent has been moved from the server to the client (Vista). Since XP and 2000 relied on the enrollment agent being available on the server, this legacy Oss are not able to request a certificate. So, how do you install a CA on a Server 2008 based system without completely upgrading all your clients to Vista first? It’s a little combination of the old and the new.

First off, you can use a Vista client to request the certificate for the legacy OS. This is all fine and dandy, but a little cumbersome. The other option is to follow a best practice and have a subordinate CA that is running Server 2003 with Web Enrollment installed. This will allow your legacy Oss to continue functioning happily in a secured environment.

12/08/2008
Correction to paragraph 2

I’ve found some contradictory information. XP/2000/2003 can still use web enroll on a Windows @008 AD CS server. AD CS will detect the legacy operating system and use Xenroll.dll to issue the certificates. One thing to note is that Smart Card enrollment is not support on the legacy applications unless you use one of the other methods mentioned.

Refferenc: http://technet.microsoft.com/en-us/library/cc732517.aspx
Labels:

Comments

Post a Comment

Popular posts from this blog

With the AD Recycle Bin Turned on, What Happens when you Create a User Account with a Password that does not meet the Password Policy?

By
This was an interesting observation from one of my Windows Server 2012 classes.  While working with the AD Recycle bin in a lab, one of my students discovered some interesting accounts that were created. When he created user accounts that did not meet password complexity requirements, an account is temporarily made and then deleted.  When a new password is provided that meets the password requirements, then a new account is made. We discovered this in two places.  First off in the Active Directory Administrative Center.  This is what caused the initial confusion.  Take a look.  This is in the Deleted Objects OU. You can see multiple deleted accounts for Test2 and one for Test3.  Test3 is a valid, functioning user account.  Using the PowerShell command Get-ADObject –IncludeDeletedObjects –Filter * –Properties ObjectSID we can see that indeed, two accounts were created, with one of them deleted. Notice the RID portion of the SID is different. ...
Post a Comment
Read more

Sticky Key problem between Windows Server 2012 and LogMeIn

By
This week I instructed my first class using Windows Server 2012 accessed via LogMeIn and discovered a Sticky Key problem every time you press the Shift key. Here is my solution to resolve this.  First off, in the Preferences of LogMeIn for the connection to the Windows Server, click General . Change the Keyboard and mouse priority to Host side user and click Apply at the bottom. On the Windows 2012 server, open the Control Panel – Ease of Access – Change how your keyboard works . Uncheck Turn on Sticky Keys . Click Set up Sticky Keys . Uncheck Turn on Sticky Keys when SHIFT is pressed five times . Click OK twice. If you are using Windows Server 2012 as a Hyper-V host, you will need to redo the Easy of Use settings on each guest operating system in order to avoid the Sticky Key Problem. Updated Information: March 20, 2013 If you continue to have problems, Uncheck Turn on Filter Keys .
6 comments
Read more

Set up your Environment to utilize Invoke-GPUpdate

By
I’m sitting in O’Hare enjoying my 3 hour layover as I get ready to teach a Windows 10 class in Fort Wayne.  I’m actually prepping for my class in Fort Wayne in a few weeks, 10982 Supporting and Troubleshooting Windows 10.  This class is very much like the Windows 7 version that I used to teach so I decided to up the detail quite a bit.  In the GPO troubleshootin chapter, I’m including a demonstration on how to use PowerShell’s Invoke-GPUpdate.  I needed to make sure the environment is set up for me to be able to utilize this cmdlet.  If you read the Notes section on Invoke-GPUpdate’s help file, you will see there are three firwall rules that need to be in place:          Remote Scheduled Tasks Management (RPC)          Remote Scheduled Tasks Management (RPC-ERMAP)          Windows Management Instrumentation (WMI-IN) I decided to create a little PowerShell script to crea...
Post a Comment
Read more