What do I need the Computer certificate for in an Active Directory domain? Theoretical Inquiry

So we are trying to clean up the thousands of certificate we have deployed.  We are on a 2008 R2 Active Directory and have been using certs for about a decade.  With all of our machines auto enrolling in Computer certificates and renewing every
year we have maybe 50,000 certificates, yes some are expired already but its a nightmare to manage.  So what do we need the Computer certificate on all the Windows machines for anyway, some are XP most are Windows 7.
Is the Computer certificate required for Kerberos authentication?
If we don't need it I rather stop publishing the Computer template and simplify our lives.
Please explain (I am not new to PKI, though this question may make me seem like a novice) I get the Web Certs, EFS, etc.

Computer certificates are not needed for Kerberos authentication.
They are typically used for 802.1x WLAN or wired authentication, or they might be used for VPN logon. Then you might used them for IPsec / "domain isolation" or perhaps DirectAccess or related solutions by other vendors.
So they are needed for some sort of "network isolation" but they are not required for default AD operations. With some the mentioned scenarios (e.g. 802.1x / IPsec) you have the choice to pick either certificates or other credentials.
Elke

Similar Messages

  • Windows 2012 R2 Active Directory Domain Services and Remote Desktop services Role on the same server.

    Findings: 
    Currently, Windows 2012 R2   AD DS role and RDS With Broker services can only seem to coexist properly in a new domain not an existing domain. Any attempt to add to an existing domain causes internal database user access denied issues and any attempt to
    adjust rights and circumvent is dubious at best.
    The escalation technician said it best. Out of 50 clients that want to do this, they end up not being able to help 5 right off the bat for whatever reason. As for the other 40 they might be able to help by running reports, adjusting rights and trying to add
    the roles until it works.  This can end up being a 20 day process. Basically they are playing whack-a-mole with user rights and permissions until something sticks.
    We tried creating an OU where any other domain policies would not be inherited to see if that was the issue, a fresh install with different sequence of adding the Roles, no effect.
    Given the errors I witnessed when running procmon and then trying to add the roles, the NT System and the Windows Internal database user had access denied issues on 100+ registry keys when trying to add the roles. After that the system is not behaving normally.
    The errors displayed almost mirror the errors that would occur on Windows 2012 when those two roles would be added which of course is officially NOT supported on that system.
    This blog needs serious revision:
    http://blogs.msdn.com/b/rds/archive/2013/07/09/what-s-new-in-remote-desktop-services-for-windows-server-2012-r2.aspx
    This is the excerpt from that blog: Single server RDS deployment including Active Directory. We now support running our RD Connection Broker role service on the same physical instance as an Active Directory Domain Controller.  In addition, we published
    guidelines for how RD Session Host could be used without the RD Connection Broker.
    Microsoft Support was curteous and helpful and they were the ones who advised cutting our losses, which mirrored my hunch after seeing what was transpiring in the system.  They refunded my money for the support call. 
    For me, it was an opportunity to find out if there was any way to configure Windows 2012 R2 in the Same manner that it was setup as Windows 2008 R2 and lay that to rest. The coexistence is poorly implemented. It is as if there was a reaction from all the deprecation
    of bread and butter features such as shadowing in TS and the coexistence of AD DS and RDS to where those features were re-added haphazardly. (I have no complaints on shadowing on Windows 2012 R2 it works, just do not like having to go to server manager to
    use it).
    I opted for virtualizing the Domain controller to eliminate the incompatibility issues and that is what I will be doing from now on. I found free solutions for backing up and reporting for virtual machines as well as the suggested procedures for configruing
    a Domain controller as a virtual machine on a Hyper-V environment and I will be sticking to those. Thus far the setup has been operational.
    I am not allergic to virtualization, but for really small setups it adds additional time and considerations but if that is how it has to be done, so be it. Windows 2008 R2 days are numbered and since we can usually squeeze 5-7 years on quality server equipment,
    buying a Windows 2008 R2 setup now is a borderline disservice in my opinion.
    Hopefully someone finds this useful and saves some time.

    Hi,
    Thank you for posting in Windows Server Forum.
    Do you need any other assistance?
    Based on your description, you are describing your story of successfully implementing RDS server with AD role and more regarding all RDS related scenario. For shadowing feature, you can use with command also. Below is the syntax to shadow a session.
    mstsc /v:<ServerName> /shadow:<SessionID>
    Hope it helps!
    Thanks.
    Dharmesh Solanki
    TechNet Community Support

  • HT5654 When I connect my iPhone to my computer, it says that I need the latest download for my iTunes to be able to sync. I already have the iOS7 and the 11.1.3 update. Whats the deal?

    When I connect my iPhone to my computer, it says that I need the latest download for my iTunes to be able to sync. I already have the iOS7 and the 11.1.3 update. Whats the deal?

    I have the same thing with my ipad "Bill's Ipad cannot be used because it requires itunes version 11.1 or later"
    Thanks for help.

  • Everything on my macbook 5.1 was erased and then the person who erased it could not find start up disc to reinstall. i called apple and gave them the serial number and they sent me leopard os 10.5 which is what originally came with the computer. not work

    i was given a macbook 5.1 by my mom, being nice, she erased everything on it, but then could not find the original start up disc. i called apple and had the serial number and said that leopard 10.5 was the operating system that orginally came with it, so i bought it. when i got it,i turned on computer, put in dvd, and immediately shut it off, then turned it back on while pressing letter c. (they told me to do this) i can hear the disc turning but alls i get is blank screen then it shuts down, and restarts. nothing ever shows up on the screen. did i get a wrong disc? should there be something different than just the mac os x leopard 10.5 to get this computer to work again?? thanks for your help!

    It means what it says. The "computer person" formatted it wrongly/ unsuitably. it needs to be formatted again.
    Error "Case-sensitive drives not supported" or similar install error | Mac OS
    Mylenium

  • Device Enrollment - Error: The server certificate for "myserver" is invalid?

    Hello,
    I am attempting to enroll my iPhone in the Lion Server Profile Manager.  I have aquires and SSL certificate on my Lion Server but do not have a code signing certificate. From my iPhone, I can log into http://myserver.mydomain.lan/mydevices and log in using my AD credentials when I try to install the Device Enrollment Profile I am prompted with the following message: The server certificate for "https://myserver.mydomain.lan/devicemanagment/api/device/ota_service" is invalid.
    Not sure how to get around this...
    I am using AD with an extended schema and was not sure if MDM absolutely requires OD credentials or if I could use my AD credentials when enrolling a device.  I was also unsure if I needed the code signing certificate which appears to be a bit pricey from Go-Daddy.  I am just test bedding MDM and do not wish to go through the expense of a code signing certificate at this point.
    Has anyone else encountered this problem?
    Thanks,
    Ray

    Not sure if this will help, but we encountered the same problem.  Our workaround was to click on the "Profiles" tab & install the Trust Profile first (not the Everyone Profile) and then enroll the device.  That seemed to work, but I don't know what's causing that error message.  Hopefully someone with more knowledge than me can answer that one.

  • ADFS2012R2 Install: Why does this need Active Directory Domain Admin Account as one of the pre requisites for installating AD FS server

    Team,
    We were trying to configure AD FS through ADFS Wizard on Windows 2012 R2 box as part of ADFS upgrade from ADFS 2.0 to ADFS 3.0. But the installation got stuck in between as the domain account which we were using does not have admin privileges on the AD side. 
    We have to raise to AD team to elevate the rights of the service accountb we are using.
    Can any one please tell me why having an admin AD account is pre requisite for the AD FS configuration, what are the "Write" changes which occur at Active Directory side post ADFS installtion, we need this details to supply to AD team for the justification
    purpose.
    Would appreciate any detailed response on this query
    thanks
    Lav

    Hi,
    dont know all exact objects ADFS is trying to create in AD, but it needs to create some container and objects under cn=Programm Data,DC=domain,dc=com for sharing certificates.
    We had troube with this because the container does'nt exists.
    Regards
    Peter
    Peter Stapf - ExpertCircle GmbH - My blog:
    JustIDM.wordpress.com

  • What if I chose the 250Gb memory for windows but I want to take away from Makos 50 Gb but I do not want reboot windows

    What if I chose the 250Gb memory for windows but I want to take away from Makos 50 Gb but I do not want reboot windows

    If I understand you correctly, you are asking how to resize your partitions for MacOS and Windows (Boot Camp) you don't want to reboot the computer to do it.  If that is correct, then I don't know of any way for you to do what you want.  In order to resize the partitions, you will need to reboot the OS that is running from the partitions, preferably exit the OS, resize the partitions, then restart the OS, so it has a clean view of the disk.

  • I bought a used macbook pro from a friend. Software updates are available, but when I try to update, the computer asks for apple id and will only accept the former owner´s. How can I connect my macbook to my apple id?

    I bought a used macbook pro from a friend. Software updates are available, but when I try to update, the computer asks for apple id and will only accept the former owner´s. How can I connect my macbook to my apple id?

    The first thing you should do after acquiring a used computer is to erase the internal drive and install a clean copy of OS X. How you do that depends on the model. Look it up on this page to see what version was originally installed.
    If the machine shipped with OS X 10.4 or 10.5, you need a boxed and shrink-wrapped retail Snow Leopard installation disc, which you can get from the Apple Store or a reputable reseller — not from eBay or anything of the kind.
    If the machine shipped with OS X 10.6, you need the gray installation discs that came with it. If you don't have the discs, order replacements from Apple. A retail disc, or the gray discs from another model, will not work.
    To boot from an optical disc, insert it, then reboot and hold down the C key at the startup chime. Release the key when you see the gray Apple logo on the screen.
    If the machine shipped with OS X 10.7 or later, it should boot into Internet Recovery mode when you hold down the key combination option-command-R at the startup chime. Release the keys when you see a spinning globe.
    Once booted from the disc or in Internet Recovery, launch Disk Utility and select the icon of the internal drive — not any of the volume icons nested beneath it. In the Partition tab, select the default options: a GUID partition table with one data volume in Mac OS Extended (Journaled) format. This operation will permanently remove all existing data on the drive, which is what you should do.
    After partitioning, quit Disk Utility and run the OS X Installer. When the installation is done, the system will automatically reboot into the Setup Assistant, which will prompt you to transfer the data from another Mac, its backups, or from a Windows computer. If you have any data to transfer, this is usually the best time to do it.
    You should then run Software Update and install all available system updates from Apple. If you want to upgrade to a major version of OS X newer than 10.6, buy it from the Mac App Store. Note that you can't keep an upgraded version that was installed by the previous owner. He or she can't legally transfer it to you, and without the Apple ID you won't be able to update it in Software Update or reinstall, if that becomes necessary. The same goes for any App Store products that the previous owner installed — you have to repurchase them.

  • I need the coding example for encapsulation

    hi all
    i need the coding example for encapsulation
    thanks in advance

    hi all
    i need the coding example for encapsulation
    thanks in advanceI see a man, hes trapped on the other side.. what Sam?... yes ... hes wearing a hood, he's a hooded gentleman, perhaps a monk who practised the black arts.... he says... "google for the answer"...

  • Lookout limitation​s and selection of the computer system for lookout

    This is regarding the limitation of the lookout i.e. upto how much IO lookout is reccomended to use.
    or it is on the basis of the l4p or lks file size basis.
    Do you have some criteria for the selection of the computer system for lookout on the basis of the IO's.
    is there any criteria by which we can check the execution cycle time for the lookout process.
    Is there any NI controller also avaiable for lookout applications?

    From what I have observed, there is no standard.  The best thing to do is to create test setups.
    Its entirely possible that a system with 100 IO may require more processing/memory than a 5000 IO system.  Database, archiving, reporting, analytics, etc.
    It is variable.
    Just for reference on our systems, we dont use the IO count for performance curves, we go based on the site configurations for the system.
    A site could be 1 pump, 6 pumps and a tank, 1 pump and a tank, 4 tanks, etc.  Consider than a tank may only take 5 IO and a well upwards of 50 IO each, we could hit 150-200 IO per site.
    Smaller systems (<10 sites) we have run very successfully on Atom based servers (not netbooks...).
    10-40 sites run well on basic dual-core workstations with 2GB or more of RAM
    40-100 we recommend quad-core servers with 4GB or more of RAM.
    (100+ gets a little more intricate)
    We try to make sure that the system is not more than 15% loaded (memory and/or CPU) by services at normal work.  Lots of room left over for future growth or unexpected workloads and backup routines.
    Forshock - Consult.Develop.Solve.

  • I need the check list for SOLMAN implementation

    Hi gurus ,
    i need the check  list for solution manager implementation and what are the things to be discuss with the client , i am new to SOLMAN, i have to do this by the evening , any one can help me out
    Cheers
    Gopal.rao

    Hi Gopal,
    I am not sure if this thread of yours is in continuation of the other thread you have started which has been replied by two other Forum members.
    The checklist depends upon which Scenario(s) of SolMan you are trying to implement.
    - Implementation/ Upgrade of ERP systems
    - Service Desk
    - Change Request Monitoring
    - Diagnostics
    - Solution Monitoring (includes BPM/ Interface monitoring)
    - Delivery of SAP Services (EWA, .....)
    Unless you specify the scenario you are seeking information on, it is difficult for anyone to pose a satisfactory reply.
    Best regards,
    Srini

  • What music app is the best replacement for iTunes 11 on OS X?  Must be able to open multiple playlists.

    What music app is the best replacement for iTunes 11 on OS X?  Must be able to open multiple playlists.

    First step before doing anything with OD is to make certain that local DNS services are correct.  To verify that, launch Terminal.app from Applications > Utilities on the test server, and issue the following harmless, diagnostic command:
    sudo changeip -checkhostname
    You'll need to enter your administrative password for the sudo to be accepted. 
    If the output from that command reports no changes are required, then an export from the original OD and an import into the test system would be typical for testing, if you trust what's in the original OD.

  • I Need the driver CD for Zen To

    i need the driver CD for my Creative Zen Touch for Windows XP
    because i lost it
    and how can I contakt the german creative support
    i dont know how i can contact creative with phone
    is there any german Creative forum ?
    or have anyone an idea how i can get the driver cd for Zen TouchMessage Edited by T3chn0fr3ak on 03-26-2006:36 PM

    Hi, ich denke mal, ich kann dir auch in deutsch antworten.
    also von dem link oben aus, w?hlst du erst mal mp3 player, dann zen und schlie?lich zen touch. auf der n?chsten seite kannst du dann dein betriebssytem ausw?hlen (sprache ist egal) und w?hlst dann noch driver aus. dann hast du auf der n?chsten seite nur eine datei zur auswahl, n?mlich den aktuellen treiber f?r windows xp f?r einen zen touch mit der alten V. Firmware. Dann m?te WIndows den Player erkennen. Zum Transfer von Musikdateien, empfehle ich dir dann noch den Nomad Explorer runterzuladen, den w?rdest du dann finden, wenn du oben anstatt driver, application ausw?hlst. Der macht das ?berspielen und verwalten der Musikdateien einfacher.
    Ansonsten besteht auch noch die M?glichkeit, die Firmware des Players upzudaten, auf die V.2 mit der Playsforsure F?higkeit. Dann reicht es, wenn auf einem Computer XP und der Mediaplayer 0 installiert sind. Ein Treiber w?re dann nicht mehr n?tig.
    Ich empfehle dir allerdings, erst mal die treibervariante auszuprobieren, da das update nicht mehr r?ckgangig zu machen ist, und wenn du mit der alten variante zufrieden bist, ein update nicht zwingend n?tig ist.
    wenn du noch fragen hast, dann schick mir ne pers?nlich nachricht, ich bin eigentlich alle zwei, drei tage in diesem forum.

  • Need the 800 number for repair center

    need the 800 number for the repair center in Grapevine TX

    Here are some HP CD/DVD Burners at Newegg.  One of them should work for you.
    As for installing the drive, it should be fairly easy.  If both sides of the case can be removed, it will make it much easier.  Just make notes when you remove the old one.  This is what I do when I replace any component.
    Signature:
    HP TouchPad - 1.2 GHz; 1 GB memory; 32 GB storage; WebOS/CyanogenMod 11(Kit Kat)
    HP 10 Plus; Android-Kit Kat; 1.0 GHz Allwinner A31 ARM Cortex A7 Quad Core Processor ; 2GB RAM Memory Long: 2 GB DDR3L SDRAM (1600MHz); 16GB disable eMMC 16GB v4.51
    HP Omen; i7-4710QH; 8 GB memory; 256 GB San Disk SSD; Win 8.1
    HP Photosmart 7520 AIO
    ++++++++++++++++++
    **Click the Thumbs Up+ to say 'Thanks' and the 'Accept as Solution' if I have solved your problem.**
    Intelligence is God given; Wisdom is the sum of our mistakes!
    I am not an HP employee.

  • What anti-virus is the most recomended for MacBook?

    Hi, I have a cuestion. What anti-virus is the most recomended for MacBook?

    pablo.asz wrote:
    ... But the true is that exist virus and I wish to know what is the best protection.
    OS X already includes everything it needs to protect itself from viruses and malware. Keep it updated with software updates from Apple.
    A much better question is "how should I protect my Mac":
    Never install any product that claims to "speed up", "clean up", "optimize", or "accelerate" your Mac. Without exception, they will do the opposite.
    Never install pirated or "cracked" software, software obtained from dubious websites, or other questionable sources. Illegally obtained software is almost certain to contain malware.
    Don’t supply your password in response to a popup window requesting it, unless you know what it is and the reason your credentials are required.
    Don’t open email attachments from email addresses that you do not recognize, or click links contained in an email:
    Most of these are scams that direct you to fraudulent sites that attempt to convince you to disclose personal information.
    Such "phishing" attempts are the 21st century equivalent of a social exploit that has existed since the dawn of civilization. Don’t fall for it.
    Apple will never ask you to reveal personal information in an email. If you receive an unexpected email from Apple saying your account will be closed unless you take immediate action, just ignore it. If your iTunes or App Store account becomes disabled for valid reasons, you will know when you try to buy something or log in to this support site, and are unable to.
    Don’t install browser extensions unless you understand their purpose. Go to the Safari menu > Preferences > Extensions. If you see any extensions that you do not recognize or understand, simply click the Uninstall button and they will be gone.
    Don’t install Java unless you are certain that you need it:
    Java, a non-Apple product, is a potential vector for malware. If you are required to use Java, be mindful of that possibility.
    Disable Java in Safari > Preferences > Security.
    Despite its name JavaScript is unrelated to Java. No malware can infect your Mac through JavaScript. It’s OK to leave it enabled.
    Block browser popups: Safari menu > Preferences > Security > and check "Block popup windows":
    Popup windows are useful and required for some websites, but popups have devolved to become a common means to deliver targeted advertising that you probably do not want.
    Popups themselves cannot infect your Mac, but many contain resource-hungry code that will slow down Internet browsing.
    If you ever see a popup indicating it detected registry errors, that your Mac is infected with some ick, or that you won some prize, it is 100% fraudulent. Ignore it.
    Ignore hyperventilating popular media outlets that thrive by promoting fear and discord with entertainment products arrogantly presented as "news". Learn what real threats actually exist and how to arm yourself against them:
    The most serious threat to your data security is phishing. To date, most of these attempts have been pathetic and are easily recognized, but that is likely to change in the future as criminals become more clever.
    OS X viruses do not exist, but intentionally malicious or poorly written code, created by either nefarious or inept individuals, is nothing new.
    Never install something without first knowing what it is, what it does, how it works, and how to get rid of it when you don’t want it any more.
    If you elect to use "anti-virus" software, familiarize yourself with its limitations and potential to cause adverse effects, and apply the principle immediately preceding this one.
    Most such utilities will only slow down and destabilize your Mac while they look for viruses that do not exist, conveying no benefit whatsoever - other than to make you "feel good" about security, when you should actually be exercising sound judgment, derived from accurate knowledge, based on verifiable facts.
    Do install updates from Apple as they become available. No one knows more about Macs and how to protect them than the company that builds them.
    Summary: Use common sense and caution when you use your Mac, just like you would in any social context. There is no product, utility, or magic talisman that can protect you from all the evils of mankind.

Maybe you are looking for