Remote Desktop server certificates are renewed two times a day despite being valid for one year

Article translations Article translations
Article ID: 2531138 - View products that this article applies to.
Expand all | Collapse all

SYMPTOMS

Consider the following scenario:
  • You want to enable a Remote Desktop server to provide server authentication by using a Secure Sockets Layer (SSL) certificate.
  • You configure a certificate template for Remote Desktop servers. To do this, you follow the settings that are described in the following link: 

    Configuring Remote Desktop certificates
In this scenario, you find that the servers are re-requesting and re-enrolling the certificates two times daily. This occurs even though the certificate template is valid for one year. Additionally, when the re-enrollment of the certificate occurs, the following event is logged in the System log:

Log Name: System
Source: Microsoft-Windows-TerminalServices-RemoteConnectionManager
Date: DD/MM/YYYY hh:mm:ss
Event ID: 1063
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: <Server1>
Description: A new template-based certificate to be used by the terminal server for Transport Layer Security (TLS) 1.0\Secure Sockets Layer (SSL) authentication and encryption has been installed. The name for this certificate is <Server1>. The SHA1 hash of the certificate is provided in the event data.


Additionally, if you have these enrolled certificates automatically published to Active Directory, the size of the Active Directory database will increase significantly because of the constant re-enrollment of the certificate. And, the Active Directory replication may pause and report the following Warning event:

Event Type: Warning
Event Source: NTDS General
Event Category: Replication
Event ID: 1079
Date: DD/MM/YYYY
Time: hh:mm:ss
User: <DOMAIN>\<DC2$>$
Computer: <DC1>
Description:
Internal event: Active Directory could not allocate enough memory to process replication tasks. Replication might be affected until more memory is available.

User Action

Increase the amount of physical memory or virtual memory and restart this domain controller.

Cause

The underlying cause of this behavior is related to the RDS component and to a mismatch within the certificate template. Specifically, if the template name and template display name are different, the RDS service does not match the existing certificate to the template, and the RDS service periodically enrolls a new certificate.

Resolution

To resolve this problem, you must set the certificate template's attribute's template display name and template name to the same value, such as RemoteDesktopComputer. This procedure is suggested in the following Microsoft TechNet article:
http://technet.microsoft.com/en-us/library/cc771869(WS.10).aspx

Then, you must update the GPO setting Computer Configuration\Policies\Administrative Templates\Windows Components\Terminal Services\Terminal Server\Security\Server Authentication Certificate Template based on the new template name, such as RemoteDesktopComputer. After the server receives the new GPO setting during the processing of the background GPO redraw, the certificates are no longer renewed on a twice-daily basis.

Important: You must set the certificate template’s attributes Template Display Name and Template Name to the same value.

Properties

Article ID: 2531138 - Last Review: October 19, 2011 - Revision: 4.2
APPLIES TO
  • Windows Automated Installation Kit for Windows 7
  • Windows Server 2008 R2 Datacenter
  • Windows Server 2008 R2 Enterprise
  • Windows Server 2008 R2 Standard
Keywords: 
KB2531138

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com