Scope
vSEC:CMS integrates with Active Directory (AD) and Microsoft (MS) CA across various workflows. This document details which user contexts execute AD lookups for each specific vSEC:CMS use case.
Admin/Agent AD Lookups
This section will describe the user contexts when performing lifecycle operations from the Admin/Agent applicaiton on a client host.
Configuration Option 1
If the AD connection used in the credential template is configured like below then the current logged on Windows account that the vSE£C:CMS application is running under will perform the AD lookup.
Important: The AD lookup will be done from the client host that the Admin/Agent applicaiton is running on in this case.
For example, I log onto my client host with a Windows account vseccms\jdoe then the AD lookups in this case will be performed by the Windows account vseccms\jdoe.
Configuration Option 2
If the AD connection used in the credential template is configured like below then the Windows account configured in the connection will perform the AD lookup (vseccms\administrator in this example).
Important: The AD lookup will be done from the client host that the Admin/Agent applicaiton is running on in this case.
vSEC:CMS User AD Lookups
This section will describe the user contexts when performing lifecycle operations from the vSEC:CMS User applicaiton on a client host.
Configuration Option 1
If the AD connection used in the credential template is configured like below then AD lookups will be performed by the AD account configured (vseccms\administrator in this example).
Important: The AD lookup will be done from the server where vSEC:CMS is running on in this case.
Configuration Option 2
If the AD connection used in the credential template is configured like below then the AD lookups will be performed by the Windows service account that vSEC:CMS service is running under.
Important: The AD lookup will be done from the server where vSEC:CMS is running on in this case.
Admin/Agent AD Lookups with MS CA
During vSEC:CMS certificate lifecycle operations, vSEC:CMS performs AD lookups by converting the selected user's DN to their SAMAccount name and embedding it in the certificate request. This section will describe the user context that will perform the AD operations during these use cases.
Configuration Option 1
If the MS CA connection used in the credential template is configured like below then the AD lookups performed will be performed by the Windows service account that vSEC:CMS service is running under..
Important: The AD lookup will be done from the server where vSEC:CMS is running on in this case as Proxy through server is enabled.
Configuration Option 2
If the MS CA connection used in the credential template is configured like below then the Windows account configured in the connection will perform the AD lookup (vseccms\ca-account in this example).
Important: The AD lookup will be done from the server where vSEC:CMS is running on in this case as Proxy through server is enabled.
Additional Tips
You can check what AD searches have been performed along with the accounts used by configuring on DC the following in registry:
And
Then from Event Viewer you can see what seraches have been performed by what user.