Issue Statement: Intermittently getting Schannel Error Event 36888: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 20. The Windows SChannel error state is 960. Cause: Cipher suite being used was TLS_DHE_RSA_WITH_AES_256_GCM_SHA384. There are some known issues […]
Read More →Problem Statement: System time on Domain Controllers and Domain Clients is out of sync. Cause: Registry entries for W32time service were not configured properly. Resolution Recommended registry settings for W32Time Service: o On PDC, • HKLM\System\CurrentControlSet\Services\W32time\Config – AnnounceFlag = 5 • HKLM\System\CurrentControlSet\Services\W32time\Config – MaxPollInterval = 10 (2^10 = 1024s) • HKLM\System\CurrentControlSet\Services\W32time\Config – MinPollInterval = 6 […]
Read More →Problem Statement: Need to remove Digital signature form KeyUsage filed of CA certificate. Cause: Want to use the Root CA and Policy CA only for CRL Signing, Offline CRL Signing and Certificate Signing only. Resolution Verified that certificate policy field was added to the certificate with OID. This needs to be matching on all CAs in […]
Read More →Issue Definition: Unable to Delegate Control on User’s SPN attribute as the Read ServicePrincipalName and Write ServicePrincipalName properties are not visible for user accounts while setting up permissions. Cause: These are the filtered properties of user objects and not visible by default. Resolution In order to make these attributes visible, you need to perform following […]
Read More →