Windows Event ID 4871 – Microsoft-Windows-Security-Auditing: Certificate Services Denied Request

Start by examining the specific details of Event ID 4871 to understand the denial reason and context.

1. Open Event Viewer on the Certificate Authority server
2. Navigate to Windows Logs → Security
3. Filter for Event ID 4871 using the filter option
4. Double-click the most recent 4871 event to view details
5. Review the General tab for key information:
   • Subject: The certificate subject that was denied
   • Template: Certificate template name
   • Requester: User or computer making the request
   • Reason: Specific denial code and description
6. Check the Details tab for additional context including request ID and CA information
7. Use PowerShell to query multiple events:

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4871} -MaxEvents 50 | Select-Object TimeCreated, @{Name='Subject';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'Subject:'}) -replace 'Subject:', ''}}, @{Name='Template';Expression={($_.Message -split '\n' | Where-Object {$_ -match 'Template:'}) -replace 'Template:', ''}}

Check if the requesting user has appropriate permissions on the certificate template being requested.

1. Open Certificate Authority management console (certsrv.msc)
2. Expand the CA server and navigate to Certificate Templates
3. Right-click the template mentioned in the 4871 event and select Properties
4. Click the Security tab to review permissions
5. Verify the requesting user or group has the following permissions:
   • Read permission (minimum required)
   • Enroll permission for user certificates
   • Autoenroll permission if using automatic enrollment
6. Use PowerShell to check template permissions programmatically:

# Get certificate template permissions
$TemplateName = "WebServer"  # Replace with actual template name
$Template = Get-CATemplate -Name $TemplateName
$Template.Security | Format-Table IdentityReference, AccessControlType, CertificateRights -AutoSize

6. If permissions are missing, add the appropriate user or group:
7. Click Add to add users or groups
8. Select the user/group and assign Enroll permissions
9. Click Apply and OK to save changes

Review the certificate template settings to identify configuration issues that might cause request denials.

1. Open Certificate Templates console (certtmpl.msc) on a domain controller or CA server
2. Locate the template referenced in the Event ID 4871
3. Right-click the template and select Properties
4. Review critical configuration areas:
   • General tab: Verify template is not disabled
   • Request Handling tab: Check purpose and key requirements
   • Subject Name tab: Verify subject name format requirements
   • Extensions tab: Review key usage and application policy extensions
5. Use PowerShell to analyze template configuration:

# Get detailed template information
$TemplateName = "WebServer"
Get-CATemplate -Name $TemplateName | Select-Object Name, DisplayName, SchemaVersion, MinimumKeySize, KeyUsage, ApplicationPolicy

6. Check if template is published to the CA:

# Verify template is available on CA
Get-CATemplate | Where-Object {$_.Name -eq $TemplateName} | Select-Object Name, IssuingCA

7. Compare template requirements with the denied request details from Event ID 4871
8. If template settings are incorrect, modify them appropriately or create a new template version

Examine Certificate Authority policy module configuration that might be causing request denials.

1. Open Certificate Authority management console
2. Right-click the CA server name and select Properties
3. Navigate to the Policy Module tab
4. Click Properties to view policy module settings
5. Review configuration options that might affect certificate issuance:
   • Subject name requirements
   • Key length restrictions
   • Certificate validity period limits
   • Extension requirements
6. Check CA registry settings for additional policy configurations:

# Check CA policy registry settings
$CAName = "YourCA-Name"  # Replace with actual CA name
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\$CAName\PolicyModules\CertificateAuthority_MicrosoftDefault.Policy" | Format-List

7. Review CA audit settings to ensure proper logging:

# Check CA audit settings
certutil -getreg CA\AuditFilter

8. If policy module settings are too restrictive, adjust them according to organizational requirements
9. Restart Certificate Services after making policy changes:

Restart-Service -Name CertSvc -Force

Perform comprehensive analysis using Certificate Authority detailed logging and network packet analysis.

1. Enable detailed CA logging for comprehensive request analysis:

# Enable maximum CA logging
certutil -setreg CA\LogLevel 5
Restart-Service -Name CertSvc

2. Check CA database for request details:

# Query CA database for denied requests
certutil -view -restrict "Disposition=30" -out "RequestID,RequesterName,CommonName,NotBefore,NotAfter" csv > denied_requests.csv

3. Analyze Certificate Services operational logs:
4. Navigate to Event Viewer → Applications and Services Logs → Microsoft → Windows → CertificateServicesClient-CertEnroll
5. Review operational events around the time of Event ID 4871
6. Use PowerShell to correlate events:

# Get related certificate enrollment events
$StartTime = (Get-Date).AddHours(-2)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-CertificateServicesClient-CertEnroll/Operational'; StartTime=$StartTime} | Where-Object {$_.LevelDisplayName -eq 'Error' -or $_.LevelDisplayName -eq 'Warning'}

6. If network issues are suspected, capture network traffic during certificate requests:
7. Use Wireshark or Network Monitor to capture HTTPS traffic on port 443
8. Filter for certificate enrollment traffic and analyze request/response patterns
9. Review IIS logs on CA servers running Certificate Enrollment Web Service:

# Analyze IIS logs for certificate enrollment errors
Get-Content "C:\inetpub\logs\LogFiles\W3SVC1\*.log" | Where-Object {$_ -match "certsrv" -and $_ -match "40[0-9]|50[0-9]"}

9. After analysis, disable verbose logging to prevent log file growth:

certutil -setreg CA\LogLevel 3
Restart-Service -Name CertSvc