Event ID 8 — Kerberos Smart Card Configuration

  • Article

Applies To: Windows Server 2008 R2

The Kerberos client can be configured to use smart card authentication for user accounts on an organization's network.

Event Details

Product: Windows Operating System
ID: 8
Source: Microsoft-Windows-Security-Kerberos
Version: 6.1
Symbolic Name: KERBEVT_BAD_CLIENT_CERTIFICATE
Message: The Domain Controller rejected the client certificate of user %2, used for smartcard logon. The following error was returned from the certificate validation process: %1.

Resolve

Reissue the smart card logon certificate

To perform this procedure, you must be an enrollment agent for the domain, or you must have been delegated the appropriate authority.

Note: The user who has a smart card logon certificate that is no longer valid is identified in the event log message.

To reissue a smart card logon certificate:

  1. In a Web browser, navigate to the certification authority (CA) that issues smart card certificates for your organization.
  2. Click Request a certificate, and then click Advanced certificate request.
  3. Click Request a certificate for a smart card on behalf of another user using the smart card certificate enrollment station. If you are prompted to accept the smart card signing certificate, click Yes.
  4. On the Smart Card Certificate Enrollment Station Web page, in Certificate Template, click Smart Card Logon.
  5. In Certification Authority, click the name of the CA you want to issue the smart card certificate.
  6. In Cryptographic Service Provider, select the cryptographic service provider (CSP) of the smart card's manufacturer.
  7. In Administrator Signing Certificate, click the Enrollment Agent certificate that will sign the enrollment request.
  8. In User To Enroll, click Select User, select the appropriate user account, and then click Enroll.
  9. When prompted, insert the smart card into the smart card reader on your computer, and then click OK.
  10. Enter the personal identification number (PIN) for the smart card.
  11. Click Yes, confirming that you want to replace the existing credentials on the smart card. 

Verify

To verify that the smart card is working properly, you should reconnect to your organization's network by using smart card authentication. Once you are connected to your organization's network, you should verify that the Kerberos ticket was created successfully by using the Klist command-line tool. Klist is used to list all cached Kerberos tickets present on the computer.

Note: Klist.exe is not included with Windows Vista, Windows Server 2003, Windows XP, or Windows 2000. You must download and install the Windows Server Resource Kit before you can use Klist.exe.

To list all cached Kerberos tickets by using Klist:

  1. Log on to the Kerberos client.
  2. Click Start, point to All Programs, click Accessories, and then click Command Prompt.
  3. Type klist tickets, and then press ENTER.
  4. Verify that a cached Kerberos ticket is available.
    • Ensure that the Client field displays the client on which you are running Klist.
    • Ensure that the Server field displays the domain in which you are connecting.
  5. Close the command prompt.

Kerberos Smart Card Configuration

Core Security