Windows Security Log Event ID 4868

4868: The certificate manager denied a pending certificate request

On this page

• Description of this event
• Field level details
• Examples

Certification Authorities and Certificate Templates can be configured to require approval by an administrator or certificate manager before the certificate is signed and issued by the CA.  In such cases the certificate request is accepted into the Pending Requests folder of the Certification Authority MMC snap-in.  The certificate manager can then Issue or Deny the request.  This event is logged when the manager denies the request.

To get the details on the request including who requested it you will need to look in the log for other events with the same Request ID.

This event event is only logged if "Issue and manage certificate requests" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Supercharger Enterprise

Load Balancing for Windows Event Collection

 

 

Upcoming Webinars The Changing Landscape of Authentication and Logon Tracking in Hybrid Environments of Entra and AD Understanding REST APIs and Their Security Issues: Secrets, Input Validation, Output Filtering, Call Limits, Automation, Authorization

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy