Collection Rule for event with source CertificationAuthority and ID 9 Rule

  • ID:  Microsoft.Windows.CertificateServices.CARole.6.3.CertSvcEvents.9
  • Description:  Certificate Services did not start: external policy module.
  • Target:  Certificate Service (2012 R2)
  • Enabled:  On Essential Monitoring

Overridable Parameters

Parameter Name Default Value Description Override
Priority 2  
Severity 2  

Run As Profiles

Name
Default

Alert Details

Message Priority Severity
AD CS Policy Module Processing High Critical

Rule Knowledgebase

Summary

The policy module contains the set of rules governing issuance, renewal, and revocation of certificates. This policy is created from hard-coded values, registry settings, and, if you are using an enterprise certification authority (CA), certificate templates. The policy module determines whether a certificate request is approved, denied, or marked as pending for an administrator to approve or deny. Problems detected with a policy module can cause a CA to fail to start or to cease functioning.

Causes
This rule does not contain any causes.
Resolutions

Enable AD CS to load a policy module

The AD CS policy modules must have sufficient memory and disk space to start correctly. If the policy modules did not start, resolve this error by :

Initializing the policy module.

If this does not resolve the error:

Identify the policy module name and contact the vendor for support.

To perform these procedures, you must have Manage CA permission, or you must have been delegated the appropriate authority.

Initialize a policy module

To enable Active Directory Certificate Services (AD CS) to initialize a policy module:

On the computer hosting the CA, clickk Start, point to Administrative Tools, and click Reliability and Performance Monitor.

Check memory usage on the computer and, if necessary, add system resources.

Restart the computer and CA.

If the policy module is not loaded and the warnings cannot be resolved by addressing related symptoms, there is likely a problem with the policy module that only the vendor can address. Therefore, identify the name of the policy module and contact the vendor for support.

For a non-Microsoft policy module, contact the policy module provider for assistance.

For a Microsoft policy module, contact Microsoft Customer Service and Support. For more information, see http://go.microsoft.com/fwlink/?LinkId=89446.

Identify the policy module name 

To identify the policy module name:

On the computer hosting the CA, click Start, point to Administrative Tools, and click Certification Authority.

Right-click the name of the CA, and click Properties.

Click the Policy Module tab, and then click Properties.

Write down the identifying information for the policy module

External References
This rule does not contain any external references.

See Also for Active Directory Certificate Services Management Pack


Downloads for Active Directory Certificate Services Management Pack

AZURE OPTIMIZATION ASSESSMENT GET STARTED
MIGRATION TO AZURE GET STARTED
SYSTEM CENTER MIGRATION TO AZURE GET STARTED
MIGRATION TO AZURE FOR SQL AND WINDOWS 2008 GET STARTED