3

In our environment, we have a Windows Certificate Authority server. We've distributed our CA to our folks, and generated some certificates with CSRs for internal websites. That works great. We tried to configure a GPO for our VMs to install the CA and also request and install an RDP certificate. I've followed some guides online, and I'm finding after about a month the server has just been nonstop issuing certificates. Every few minutes it seems. I now have well over 30,000 certificates issues when our environment only has 200 VMs. Has anyone seen this before? Is there anything I can check? I included some screenshots of the GPO we've configured. enter image description here

enter image description here

enter image description here

Improve this question
8
  • 2
    I would check if client is able to successfully validate its own RDS certificate. For example, export RDS certificate on a client VM and run certutil -verify -urlfetch rdscert.cer and examine output. In addition, a screenshot of General tab of RDS certificate template would be helpful
    – Crypt32
    Apr 28, 2021 at 17:12
  • 2
    BTW, make sure that no principal has Autoenroll permissions on RDS template.
    – Crypt32
    Apr 28, 2021 at 17:41
  • @Crypt32 - The verify passed successfully. I didn't see any glaring errors there. I did notice the RDP cert went into the Local Computer -> Personal -> Certificates folder rather than the Remote Desktop -> Certificates folder. I'll try and get a screenshot posted of the General Tab. Looking at permissions, "Domain Computers" & "Domain Controllers" both have Auto Enroll permission allow checked.
    – Jakob
    Apr 28, 2021 at 17:45
  • 2
    You MUST uncheck Autoenroll permission for all principals in ACL. Thanks to General tab, it looks ok.
    – Crypt32
    Apr 28, 2021 at 17:54
  • 1
    yes, autoenrollment can cause this. RDS implements its own automatic renewal mechanism and gets mad when autoenrollment is enabled.
    – Crypt32
    Apr 28, 2021 at 18:12

1 Answer 1

Reset to default
2

Just for the sake of posting the confirmed solution (I was suspecting on).

If you deploy RDS/RDP certificates using new dedicated RDS certificate deployment GPO, then you *MUST NOT* enable Autoenroll permissions on certificate template. GPO mechanism implements its own renewal process and goes into a conflict with Windows Certificate Autoenrollment mechanism.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .