Windows Event ID 4868 – Security: Certificate Services Denied Request

Start by examining the complete Event ID 4868 details to understand the specific denial reason and context.

1. Open Event Viewer on the Certificate Authority server
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4868 using the filter option
4. Double-click the most recent 4868 event to view full details
5. Record the following key information from the event:
   • Subject name requested
   • Certificate template name
   • Requesting user account
   • Denial reason code
   • CA name and server
6. Use PowerShell to extract multiple events for pattern analysis:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4868} -MaxEvents 50 | Select-Object TimeCreated, @{Name='User';Expression={$_.Properties[1].Value}}, @{Name='Template';Expression={$_.Properties[4].Value}}, @{Name='Reason';Expression={$_.Properties[6].Value}} | Format-Table -AutoSize

This method provides immediate visibility into certificate denial patterns and helps identify whether issues are isolated incidents or systematic problems.

Check certificate template security settings to ensure proper permissions are configured for the requesting users or computers.

1. Open Certificate Authority management console on the CA server
2. Expand the CA name and click Certificate Templates
3. Right-click the template mentioned in Event ID 4868 and select Properties
4. Click the Security tab to review permissions
5. Verify the requesting user or computer account has appropriate permissions:
   • Read - Required for all certificate requests
   • Enroll - Required for standard certificate enrollment
   • Autoenroll - Required for automatic enrollment scenarios
6. Use PowerShell to audit template permissions across multiple templates:

Import-Module ActiveDirectory
$Templates = Get-ADObject -Filter {objectClass -eq 'pKICertificateTemplate'} -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)"
foreach ($Template in $Templates) {
    $ACL = Get-ACL "AD:$($Template.DistinguishedName)"
    Write-Host "Template: $($Template.Name)"
    $ACL.Access | Where-Object {$_.IdentityReference -like "*Domain Users*" -or $_.IdentityReference -like "*Authenticated Users*"} | Format-Table IdentityReference, ActiveDirectoryRights, AccessControlType
}

Add the requesting user or appropriate security group to the template permissions if access is legitimately required.

Review the certificate template settings to identify configuration issues that might cause request denials.

1. In the Certificate Authority console, right-click the problematic template and select Properties
2. Review the General tab for validity period and renewal settings
3. Check the Request Handling tab for:
   • Purpose settings (Encryption, Signature, etc.)
   • Key usage requirements
   • Minimum key size settings
   • Cryptographic provider requirements
4. Examine the Subject Name tab for subject name restrictions
5. Review the Extensions tab for enhanced key usage and application policy settings
6. Use PowerShell to export template configuration for analysis:

$TemplateName = "WebServer"  # Replace with your template name
$Template = Get-ADObject -Filter {Name -eq $TemplateName -and objectClass -eq 'pKICertificateTemplate'} -Properties *
$Template | Select-Object Name, DisplayName, @{Name='ValidityPeriod';Expression={$_.pKIDefaultKeySpec}}, @{Name='KeyUsage';Expression={$_.pKIKeyUsage}}, @{Name='EKU';Expression={$_.pKIExtendedKeyUsage}} | Format-List

Examine Certificate Authority policies and database health to identify system-level issues causing certificate denials.

1. Check CA policy settings using the Certificate Authority console:
   • Right-click the CA name and select Properties
   • Review the Policy Module tab settings
   • Check the Exit Module configuration
2. Verify CA database connectivity and health:

# Check CA service status
Get-Service -Name CertSvc | Format-List Name, Status, StartType

# Verify CA database integrity
certutil -v -db

# Check CA configuration
certutil -cainfo

# Review recent CA database transactions
certutil -view -restrict "RequestId>=$((Get-Date).AddDays(-1).ToString('yyyy-MM-dd'))" csv > CARequests.csv

Get-WinEvent -FilterHashtable @{LogName='Application'; ProviderName='Microsoft-Windows-CertificationAuthority'} -MaxEvents 100 | Where-Object {$_.LevelDisplayName -eq 'Error' -or $_.LevelDisplayName -eq 'Warning'} | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

# Review CA policy settings
Get-ItemProperty -Path "HKLM\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\*" | Select-Object PSChildName, ValidityPeriod, ValidityPeriodUnits

Implement comprehensive PKI monitoring and use advanced troubleshooting techniques for complex certificate denial scenarios.

1. Enable detailed CA logging for enhanced troubleshooting:

# Enable CA debug logging
certutil -setreg ca\Debug 0xffffffe3
Restart-Service CertSvc

# Configure CA to log all certificate operations
certutil -setreg ca\AuditFilter 127

# Create scheduled task to monitor certificate denials
$Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-Command Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4868; StartTime=(Get-Date).AddHours(-1)} | Export-Csv C:\Logs\CertDenials.csv -Append"
$Trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Hours 1)
Register-ScheduledTask -TaskName "Monitor-CertificateDenials" -Action $Action -Trigger $Trigger

# Analyze denial patterns by template and user
$Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4868; StartTime=(Get-Date).AddDays(-7)}
$Analysis = $Events | ForEach-Object {
    [PSCustomObject]@{
        Time = $_.TimeCreated
        User = $_.Properties[1].Value
        Template = $_.Properties[4].Value
        Reason = $_.Properties[6].Value
        CA = $_.Properties[7].Value
    }
}
$Analysis | Group-Object Template | Sort-Object Count -Descending | Format-Table Name, Count

# Test certificate request using certreq
$TestINF = @"
[NewRequest]
Subject = "CN=TestCert,OU=IT,O=Company,C=US"
KeyLength = 2048
KeySpec = 1
MachineKeySet = TRUE
RequestType = PKCS10
[RequestAttributes]
CertificateTemplate = WebServer
"@
$TestINF | Out-File -FilePath C:\temp\test.inf
certreq -new C:\temp\test.inf C:\temp\test.req
certreq -submit -config "CA-Server\CA-Name" C:\temp\test.req C:\temp\test.cer