Scope
vSEC:CMS integrates with Active Directory (AD) and Microsoft (MS) CA across various workflows. This document details which user contexts execute AD lookups for each specific vSEC:CMS use case.
Admin/Agent AD Lookups
This section will describe the user contexts when performing lifecycle operations from the Admin/Agent applicaiton on a client host.
Configuration Option 1
If the AD connection used in the credential template is configured like below then the current logged on Windows account that the vSEC:CMS application is running under will perform the AD lookup.
Important: The AD lookup will be performed from the client host that the Admin/Agent applicaiton is running on in this case.
For example, I log onto my client host with a Windows account vseccms\jdoe then the AD lookups in this case will be performed by the Windows account vseccms\jdoe.
Configuration Option 2
If the AD connection used in the credential template is configured like below then the Windows account configured in the connection will perform the AD lookup (vseccms\administrator in this example).
Important: The AD lookup will be performed from the client host that the Admin/Agent applicaiton is running on in this case.
vSEC:CMS User AD Lookups
This section will describe the user contexts when performing lifecycle operations from the vSEC:CMS User applicaiton on a client host.
Configuration Option 1
If the AD connection used in the credential template is configured like below then the AD lookups will be performed by the Windows service account that vSEC:CMS service is running under.
Important: The AD lookup will be performed from the server where vSEC:CMS is running on in this case.
Configuration Option 2
If the AD connection used in the credential template is configured like below then AD lookups will be performed by the AD account configured (vseccms\administrator in this example).
Important: The AD lookup will be performed from the server where vSEC:CMS is running on in this case.
Admin/Agent AD Lookups with MS CA
During vSEC:CMS certificate lifecycle operations, vSEC:CMS performs AD lookups when communicating with the MS CA. This section will describe the user context that will perform the AD operations when certificate related operations are being perormed.
Configuration Option 1
If the MS CA connection used in the credential template is configured like below then the AD lookups performed will be performed by the Windows service account that vSEC:CMS service is running under.
Important: The AD lookup will be performed from the server where vSEC:CMS is running on in this case as Proxy through server is enabled. If you disable Sign server side (which is not recommended) and then disable Proxy through server then the AD lookups will be performed from the client host that the Admin/Agent application is running on.
Configuration Option 2
If the MS CA connection used in the credential template is configured like below then the Windows account configured in the connection will perform the AD lookup (vseccms\ca-account in this example).
Important: The AD lookup will be performed from the server where vSEC:CMS is running on in this case as Proxy through server is enabled. If you disable Sign server side (which is not recommended) and then disable Proxy through server then the AD lookups will be performed from the client host that the Admin/Agent application is running on.
Additional Tips
You can check what AD searches have been performed along with the accounts used by configuring on DC the following in registry:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters]
DWORD: Expensive Search Results Threshold value 1
DWORD: Inefficient Search Results Threshold value 1
And
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics]
DWORD: 15 Field Engineering value 5
Then from Event Viewer you can see what seraches have been performed by what user.