We have a user account, "Temp_admin " which was set up as a temporary domain admin, which was deleted a few months ago. For some reason this account is still triggering and Successfully being authenticated for certificate enrollment
on our internal certificate server. At least according to the application log on Dc#4. Looking at the logs on our certificate server this user does not even exist. event ID's 64 and 65 every 3-4 minutes with this. Any idea how to stop this or atleast keep
it from authenticating?
Server 2008r2 domain.
Certificate enrollment for *******\Temp_admin successfully load policy from policy server
-<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <ProviderName="Microsoft-Windows-CertificateServicesClient-CertEnroll" Guid="{54164045-7C50-4905-963F-E5BC1EEF0CCA}"
EventSourceName="CertEnroll" />
<EventID Qualifiers="33370">64</EventID>
<Keywords>0x80000000000000</Keywords>
<TimeCreated
SystemTime="2014-09-02T19:56:04.000000000Z" />
<EventRecordID>99069</EventRecordID>
<ExecutionProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>MDSTVDC04.*******.local</Computer>
<SecurityUserID="S-1-5-21-420886195-1495481658-928725530-6981" />
</System>
<Data Name="Context">*******\Temp_admin</Data>
</EventData>
</Event>
Certificate enrollment for *******\Temp_admin is successfully authenticated by policy server {0E730552-3DDB-465A-83AD-CFAF040B236B}
-<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <ProviderName="Microsoft-Windows-CertificateServicesClient-CertEnroll" Guid="{54164045-7C50-4905-963F-E5BC1EEF0CCA}"
EventSourceName="CertEnroll" />
<EventID Qualifiers="33370">65</EventID>
<Keywords>0x80000000000000</Keywords>
<TimeCreated
SystemTime="2014-09-02T19:56:04.000000000Z" />
<EventRecordID>99068</EventRecordID>
<ExecutionProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>MDSTVDC04.*******.local</Computer>
<SecurityUserID="S-1-5-21-420886195-1495481658-928725530-6981" />
</System>
<Data Name="Context">*******\Temp_admin</Data>
<Data Name="ServerURL">{0E730552-3DDB-465A-83AD-CFAF040B236B}</Data>
</EventData>
</Event>