How to trigger an event log entry when ADCS Role Separation is turned on or off

Mike Bruno 136 Reputation points
2020-08-27T14:56:19.043+00:00

This article indicates that if you have the CA\AuditFilter property set t the max value (127) an event log entry would be triggered when we turn Role Separation on or off. The event ID should be 801:
https://www.serverbrain.org/certificate-security-2003/enabling-auditing-at-the-ca.html

This is not occurring for us, and we're not seeing any other event log entries related to the change.

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,774 questions
Accepted answer
  1. Daisy Zhou 20,791 Reputation points Microsoft Vendor
    2020-08-28T02:40:30.877+00:00

    Hello, @Mike Bruno ,

    Thank you for posting here.

    Based on my test in lab, we need to configure two audit group policy settings:

    1.To audit events, the computer must be configured for auditing certification services. Audit policy options can be viewed and managed in local or domain Group Policy under Computer Configuration\Windows Settings\Security Settings\Advanced Audit Policy Configuration\Object Access\ Audit Certification Services.
    20939-au1.png

    2.To audit events, the computer must also be configured for auditing of object access. Audit policy options can be viewed and managed in local or domain Group Policy under Computer Configuration\Windows Settings\Security Settings\Local Policies.
    21085-au4.png

    We can enable role separation by entering the following certutil command and then restarting Active Directory Certificate Services (AD CS):

    certutil -setreg CA\RoleSeparationEnabled 1

    20989-au2.png

    Similarly, to disable role separation, a local administrator on the CA server can enter

    certutil -delreg CA\RoleSeparationEnabled

    21066-au3.png

    Tip: my CA is Windows server 2019, and the Event ID is **4897 when I turn Role Separation on or off.**

    For more information, we can refer to the links below.

    Q: How can I make sure that a given Windows account is assigned only a single Certification Authority (CA) management role?
    https://www.itprotoday.com/security/q-how-can-i-make-sure-given-windows-account-assigned-only-single-certification-authority-ca

    Configure CA Event Auditing
    https://video2.skills-academy.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc772451(v=ws.10)?redirectedfrom=MSDN

    Hope the information above is helpful.

    Best Regards,
    Daisy Zhou

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vadims Podāns 9,116 Reputation points MVP
    2020-08-27T15:02:01.84+00:00

    ADCS audit is a two-step process:

    1. Enable audit filter on CA itself
    2. Enable Certification Authority Audit component in Audit Object Access in group policies.