| Event Information | According to Microsoft :
Cause :
This event is logged when the client has failed to validate the Domain
Controller certificate.
Resolution :
Request a new domain controller certificate
The Kerberos
client validates the domain controller certificate to ensure that the communication is encrypted.
To resolve this
issue:
- Delete the domain controller certificate that is no longer valid.
- Request a new
certificate.
To perform these procedures, you must be a member of the Domain Admins group, or you must have been delegated the appropriate
authority.
Delete the domain controller certificate that is no longer valid
To delete the domain controller
certificate that is no longer valid:- On the domain controller, click Start, and then click Run.
- Type mmc.exe,
and then press ENTER.
- If the User Account Control dialog box appears, confirm that the action it displays is what you
want, and then click Continue.
- Click File, and then click Add/Remove Snap-in.
- Click Certificates, and then
click Add.
- Click Computer account, click Next, and then click Finish.
- Click OK to open the Certificates
snap-in.
- Expand Certificates (Local computer), expand Personal, and then click Certificates.
- Right-click the
old domain controller certificate, and then click Delete.
- Click Yes, confirming that you want to delete the
certificate.
- After the certificate is deleted, follow the procedure in the "Request a new certificate" section.
Request a new certificate
To request a new certificate:
- Expand Certificates (Local
computer),right-click Personal, and then click Request New Certificate.
- Complete the appropriate information in the
Certificate Enrollment Wizard for a domain controller certificate.
- Close the Certificates snap-in.
Verify
To perform this procedure, you must be a member of the Domain Admins group, or you must
have been delegated the appropriate authority.
To verify that the Kerberos Key Distribution Center (KDC) certificate
is available and working properly:- Click Start, point to All Programs, click Accessories, right-click Command Prompt,
and then click Run as administrator.
- If the User Account Control dialog box appears, confirm that the action it
displays is what you want, and then click Continue.
- At the command prompt, type certutil -dcinfo verify, and then
press ENTER.
- If you receive a successful verification, the Kerberos KDC certificate is installed and operating correctly.
|