Administration

Table 5-9. Enrollment Server Connectivity (continued)
Status Text Description
The <FQDN> enrollment server
has read the enrollment properties
at least once, but has not been
able to reach a domain controller
for some time.
As long as the enrollment server reads the PKI configuration from a domain
controller, it keeps polling for changes once every two minutes. This status will
be set if the domain controller (DC) has been unreachable for a short period of
time. Typically this inability to contact the DC might mean the enrollment server
cannot detect any changes in PKI configuration. As long the certificate servers can
still access a domain controller, certificates can still be issued.
The <FQDN> enrollment server
has read the enrollment properties
at least once but either has not
been able to reach a domain
controller for an extended time or
another issue exists.
If the enrollment server has not been able to reach the domain controller for an
extended period, then this state is displayed. The enrollment server will then try
to discover an alternative domain controller for this domain. If a certificate server
can still access a domain controller, then certificates can still be issued, but if this
state remains for more than one minute, it means the enrollment server has lost
access to all domain controllers for the domain, and it is likely that certificates can
no longer be issued.
Table 5-10. Enrollment Certificate Status
Status Text Description
A valid enrollment certificate for
this domain's <domain name>
forest is not installed on the
<FQDN> enrollment server, or it
may have expired
No enrollment certificate for this domain has been installed, or the certificate is
invalid or has expired. The enrollment certificate must be issued by an enterprise
CA that is trusted by the forest this domain is a member of. Verify that you have
completed the steps in the Horizon 7 Administration document, which describes
how to install the enrollment certificate on the enrollment server. You can also
open the MMC, certificate management snap-in, opening the local computer
store. Open the Personal certificate container and verify that the certificate is
installed, and that it is valid. You can also open the enrollment server log file. The
enrollment server will log additional information about the state of any certificate it
located.
Table 5-11. Certificate Template Status
Status Text Description
The template <name> does not
exist on the <FQDN> enrollment
server domain.
Check that you specified the correct template name.
Certificates generated by this
template can NOT be used to log
on to windows.
This template does not have the smart card usage enabled and data signing
enabled. Check that you specified the correct template name. Verify that you
have .completed the steps described in Create Certificate Templates Used with
True SSO.
The template <name> is smartcard
logon enabled, but cannot be
used.
This template is enabled for smart card logon, but the template cannot be used
with True SSO. Check that you specified the correct template name, verify that
you have gone through the steps described in Create Certificate Templates Used
with True SSO. You can also check the enrollment server log file, since it will log
what setting in the template is preventing it from being used for True SSO.
Horizon 7 Administration
VMware, Inc. 123