Win7, 64 bit, Windows Certificate Services Client-Auto Enrollment

[sewcat7]

Hi, in the Event Viewer I have been getting an error, Event ID 64. I have followed it up, but when I click on the Certificate to renew it, I get message that Windows cannot renew it. Apparently the Certificate will expire on 2/7. I tried to delete it and I get message that it is needed for encryption. Below is the exact message. Do I have to do anything????


Log Name: Application
Source: Microsoft-Windows-CertificateServicesClient-AutoEnrollment
Date: 22/06/2012 2:43:56 PM
Event ID: 64
Task Category: None
Level: Warning
Keywords: Classic
User: N/A

Description:
Certificate for local system with Thumbprint 7e 2f ce f9 7e 33 fb 1a 59 16 f5 0f a5 d3 fc a2 ed 18 21 2f is about to expire or already expired.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CertificateServicesClient-AutoEnrollment" Guid="{F0DB7EF8-B6F3-4005-9937-FEB77B9E1B43}" EventSourceName="AutoEnrollment" />
<EventID Qualifiers="32768">64</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-06-22T04:43:56.000000000Z" />
<EventRecordID>18541</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>

<Security />
</System>
<EventData>
<Data Name="Context">local system</Data>
<Data Name="ObjId">7e 2f ce f9 7e 33 fb 1a 59 16 f5 0f a5 d3 fc a2 ed 18 21 2f</Data>
</EventData>
</Event>

 

[A Guy]

Have a look at the Resolve section on this page:

Event ID 64

A Guy

 

[cluberti]

If the system is part of a domain, it could be a problem with either the certificate server(s) in the domain, the domain computer account, permissions on the certificate server, etc. Is this machine joined to a domain?

 

[sewcat7]

Win7, 64 bit, Windows Certificate Services Client - Auto Enrollment

Have a look at the Resolve section on this page:

Event ID 64

A Guy

Hi Guy, thanks for your suggestion, I have followed it all and then Windows informed me that the Certificate cannot be renewed. A template is mentioned, but I have no idea what to do about it. I have meanwhile found that in IE9, under Content, Certificates, the Certificate is listed (the only one). Apparently it was issued in February and expired about a week later. I also found that this is a public key and I also have a private key. When I tried to delete it, the message comes up, that I will no longer be able to Decrypt encrypted messages. Maybe you have further suggestions. Thanks Sewcat7

 

[sewcat7]

Win 7, 64 bit Windows Certificate Services Client Auto Enrollment

If the system is part of a domain, it could be a problem with either the certificate server(s) in the domain, the domain computer account, permissions on the certificate server, etc. Is this machine joined to a domain?

Hi Cluberti, thanks for your answer. I am not quite sure, what it means to be joined to a domain. It is a standalone PC (home user), although in our house there also is a laptop and a Mac (same ISP). I have meanwhile found the certificate under IE9, Internet Option, Content, Certificates. It is a Token Signing Public Key and it expired on 12/2. The reason for it seems to be Client authentication and I seem to also have a private key. I tried to delete it, but it comes up with the message that encrypted messages can then no longer be decrypted. Sewcat7

 

[A Guy]

A bit beyond me as well. Generally the certificates are updated automatically without user intervention. If there is no impact on your usage, I wouldn't be concerned. Perhaps cluberti in his infinite wisdom will have more info

A Guy

 

[sewcat7]

Win7,64 bit, Windows Certificate ...

Hi Guy, thanks for trying. Sewcat7

 

[cluberti]

If it's only in IE that you see it listed, it should be safe to remove in a home user scenario as it would only be used for authentication to a site or to encrypt (SSL) the contents of your communication with a site.

 

[sewcat7]

Win 7, 64 bit, Windows Certificate Services Client...

Hi Cuberti, before I delete it, it was also listed in the Registry under Personal Certificates. I will create a Restore Point and see what happens. Thanks for your help. Sewcat7

 

[cluberti]

Yes, it was probably used for authentication to a web site somewhere at some point (given the age, it wasn't recent). Restore point isn't a bad idea, but you should be OK.

 

[sewcat7]

Win 7, 64 bit, Windows Certificate Srvices Client - Auto Enrollment

If it's only in IE that you see it listed, it should be safe to remove in a home user scenario as it would only be used for authentication to a site or to encrypt (SSL) the contents of your communication with a site.

Hi Cuberti, I deleted it in IE9, but it still appears as an Error in the Event Viewer. I agree with you, that it probably was only used for authentication to a site. Do you think, I can delete it in the Registry as well?? Thanks for your help. Sewcat7