Re: Computer Certificate Private Key
The only way to stop this is, as I have said repeatedly in this thread, is
to upgrade the issuing CA to Enterprise Edition.
Only v2 certificate templates give you the control that you desire.
Brian
"Mr.B" <MrB@discussions.microsoft.com> wrote in message
news:1274E9BA-D3A0-49BE-9BCF-83307AA8509C@microsoft.com...
> But by default IT IS. And I have to find out, how to prevent these.
> I have auto enrollment for computer template. Server is 2003 Standard CA
> is
> Subordinate Enterprise.
>
> "Brian Komar" wrote:
>
>> Actually
>> The computer account is authenticating to the domain. *You* have decided
>> to
>> export a private key and import it on a non-trusted host (based on the
>> tone
>> of your response).
>> It is not a security breach if *you* decide to put the private key on the
>> offending host.
>> Now, you see why the key is non-exportable
>> Brian
>>
>> "Mr.B" <MrB@discussions.microsoft.com> wrote in message
>> news:6CCF2445-5EF1-4E54-8A5F-F2C14BD7346A@microsoft.com...
>> > Interested.
>> > I have set up 802.1x. I will test it tomorrow. SO i can excepted that
>> > computer will be authenticated with 802.1x. So computer get in to
>> > private
>> > network, but it does not authenticate to domain. But that is security
>> > birch.
>> > Problem is that I use v1 computer template, and I don’t now, how to
>> > make
>> > automotive request, with option, do not export private can, or make it
>> > exportable….
>> >
>> >
>> > "Alun Jones" wrote:
>> >
>> >> "Mr.B" <MrB@discussions.microsoft.com> wrote in message
>> >> news:C70A8D7E-E75E-45ED-834B-D8ADB05521CE@microsoft.com...
>> >> > By default, if i set up auto enrollment for computer certificate, i
>> >> > can
>> >> > from
>> >> > computer export private key.
>> >> > What would happened, if i import these key to different computer.
>> >> > If I use different computer and i tried to authenticate, to IAS,
>> >> > would
>> >> > it
>> >> > exempted as valid ?
>> >>
>> >> Cryptography assumes that if you have the private key, you are the
>> >> individual or computer identified as associated with that key.
>> >>
>> >> However, the recipient of a signed key exchange (in this case, IAS)
>> >> might
>> >> note that your computer is trying to authenticate as a computer name
>> >> other
>> >> than that with which it passed NTLM authentication. In such a case, it
>> >> would
>> >> almost certainly fail the authentication.
>> >>
>> >> Alun.
>> >> ~~~~
>> >>
>> >>
>> >>
>>
