Best Practices: Using Active Roles Server in Smart Card Authentication Environment (4321688)

The information provided in this article can help you use Active Roles Server in the environment with the Smart Card Authentication enabled and troubleshoot the issues that may arise.

Symptoms:

• Active Roles hangs on creating a computer account
• Active Roles hangs when trying to reset a password for a user
• Active Roles hangs when trying to create a user
• Active Roles hangs when trying to deprovision a user

*Note: Symptoms will be present in both the Web Interface and Console clients

• The user profile of the Active Roles Administration Service account contains a cached smart-card certificate.
• This cached certificate is valid for logging on to the managed domain.
• As a result, SChannel SSPI Provider attempts to use that certificate for authentication.
• However, since the certificate private key is located on the smart card, the SChannel provider prompts for the smart card to be inserted and the PIN code to be entered.
• Active Roles Administration Service has no way to prevent ADSI Provider from attempting to authenticate using SChannel.
• ADSI Provider is not aware that the private key for the certificate requires the smart card to be inserted.
• When creating a computer account, Active Roles sets a random password the for new account.
• When setting the password, Microsoft LDAP ADSI Provider will prefer to use LDAP over TLS (SSL) together with SChannel SSPI provider to authenticate to the domain controller.
• The SChannel SSPI provider will attempt to use the cached certificate in the user profile, and this will trigger a prompt to insert the actual smart card and enter the PIN.

BEST PRACTICES

• Disable Smart Card Authentication for the Active Roles Administration Service account
• Make sure the Certificate Propagation from smart card feature is Disabled in the Group Policy settings for smart cards (see the attached screenshot).
• Avoid logging on to the Active Roles Server computer as the Active Roles Administration Service account with a smart card inserted.
  • If you do so, Windows may cache the certificates on the smart card (without the private key) to the user profile.

WORKAROUND

1. Stop the Active Roles Administration Service
2. Make sure that the smart card is not inserted, so that the certificate is not cached again, as it can even be accessed across a Remote Desktop session.
3. Log on interactively to the Active Roles Administration Service computer as the Active Roles service account
4. Run the Certificate Manager MMC snap-in (certmgr.msc)
5. Find and delete the cached smart card certificate from the "Personal/Certificates" folder.
   If you don't have the smart card inserted, this will not affect the actual certificate on the smart card.
6. Start the Active Roles Administration Service