Generate certificate request for SCOM

SCOM uses certificates for mutual authentication between agent and server for standalone machines or machines in a different Active Directory.

1.  Get your Root CA certificate as a file and import to the Trusted Root Authorities store, if not already done.

2. Create a file named scom.inf:

Hint: If your agent machine not in AD please configure the computer full name with domain name, e.g. server1.crypto-live.org

[NewRequest]

Subject="CN="

Exportable=TRUE

KeyLength=1024

KeySpec=1

KeyUsage=0xf0

MachineKeySet=TRUE

[EnhancedKeyUsageExtension]

OID=1.3.6.1.5.5.7.3.1

OID=1.3.6.1.5.5.7.3.2

Both OIDs needed for server and client authentication.3.  Create a new certificate request file hostname.csr:

CertReq.exe -New -f scom.inf .csr

4. If not already done, make a copy of the Web Server certificate template and call it "SCOM Machine". Ensure key must be exportable and extended usage must include client authentication and server authentication. Assign access rights for your user accounts and assign the "SCOM Machine" certificate template to the Certification Authority.

4.  Submit the request to your CA.

5.  Download the certificate to a file .cer


6.  Import the certificate into certificate store :

CertReq.exe -accept NewCertificate.cer

7. Run momcertimport.exe to tell the SCOM agent the new certificate.

Not just another screenshot tool - Greenshot

Greenshot is a great screenshot tool. I like:
- easy to select a region, current window or screen
- automatic saving to a folder with numbering (tons of options)
- image formats: png, jpeg, gif or bmp
- easy to highlight text or add notes
- use Print Screen key, so easy to remember hotkeys :-)
- under GPL, can be used free of charge

http://getgreenshot.org/

WSUS Cleanup

Windows Update Service is a great tool to manage and distribute patches from Microsoft with your organization.

There is a GUI based way to do it. But there is a great tool available from the CodePlex website http://wsus.codeplex.com/releases/view/17612 to run it as a regular maintenance scheduled task.

It will save you disk space and can also remove orphaned computer entries.

Microsoft has a patch day once a month on the second Tuesday. Some patches will come during the month too.

So please sync first your WSUS with Microsoft and run e.g. once a month the WSUS Cleanup tool.

Microsoft Online Demo Solutions

Update 8/10/2011: Unfortunately Microsoft decided to stop the demo.

Microsoft Online Demo Solutions

If you are looking for a demo ready environment with fast and hassle free installation have a look for the Business Ready Security demo from Microsoft. There is a only demo, just start it or schedule it for 1 to 6 hours, perfect for a customer demo, quick look into the products or configurations, or download a set of HyperV VMs and run it on your own host. The HyperV VMs are trial versions but you can install additional software or connect to your mail system as you want.

The Online Demos can save a lot of time! So try the online demo today and if that is great for you, download and run it in your iron.

Just a few installed products: ADFS, AD, UAG, TMG, Office, Sharepoint, Exchange, RMS, RSA DLP, FIM IdM

iPCUScripting.dll. - Google Search

iPCUScripting.dll. - Google Search

ISSA International Conference Atlanta, GA - Sep 16 2010

Don't miss the ISSA International Conference

https://www.issa.org/conf/?p=169

Looking forward to see you there.

Key recovery agent certificate for a Windows CA

You might know that there is the key archival option included only in the Windows Enterprise editions on 2003, 2003 R2, 2008 and 2008 R2.

It is used to have a backup of each user certificate in the case that the user lost her certificate or she left the company. Make sure that you follow all legal procedures. But back to the technical part. If you follow the standard procedures in all Microsoft documents you have to deal with certificate templates, publish the template, deal with access permissions, log on as a user and request a key recovery agent (KRA) certificate and the private key is stored on a windows machine.

With openssl you can create private key and certificate on a secured standalone machine, Windows or Unix does not matter. For example copy the KRA certificates to Smart Cards and only copy the public part of the certificate to the CA.

Howto:

- add in openssl.cnf NEW_OIDS section the line

KEY_RECOVERY_AGENT=1.3.6.1.4.1.311.21.6
- add in openssl.cnf v3_ca section two lines
keyUsage=keyEncipherment
extendedKeyUsage=KEY_RECOVERY_AGENT
- remove or comment line basicConstraints = CA:true

- generate a new RSA key

openssl genrsa -aes256 -out kra1.key 2048

- generate a self signed certificate for x days, x can max to the CA cert validity

openssl req -new -x509 -days 365 -key kra1.key -config openssl.cnf -out kra1.cer

- copy only ht kra1.cer to the CA and add import it also to the Root CA store to make it valid for the CA service. To add it to the Root CA store is only necessary on the CA itself, there is no need to do so on any other servers or clients in your environment.

- Configure the KRA1 certificate in the CA.

Certutil -f -enterprise -addstore KRA KRA1.cer
Certutil -f -enterprise -addstore Root KRA1.cer

Go through the same procedure for a KRA2.

If you wanna have that as a PFX file:

openssl pkcs12 -export -in kra1.cer -inkey kra1.key -out kra1.pfx

Best practise:

- Never copy the private key to the CA itself

- Secure your KRA with password or move it to a set of smart cards

- Have at least 2 KRA installed and set the CA to use all!!

- Use at least a 2048 bit key

- Verify access to KRA on a regular basis, e.g. every 12 months

- Have a approved process for key escrow and data recovery