Windows Security Log Event ID 4889

4889: Certificate Services set the status of a certificate request to pending

On this page

• Description of this event
• Field level details
• Examples

Certification Authorities and Certificate Templates can be configured to require approval by an administrator or certificate manager before the certificate is signed and issued by the CA. 

In such cases the certificate request is received (event 4886) and placed into the Pending Requests folder of the Certification Authority MMC snap-in.  

This event, 4889, is logged when the request is submitted to Pending.  The certificate manager can then Issue (event 4887) or Deny (event ID 4868) the request. 

This event event is only logged if "Issue and manage certificate requests" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.

Request ID: To get the details on the request including who requested it you will need to look in the log for other events with the same Request ID.

Requester: the account that requested the certificate

Attributes:  unknown.  if you have information to share on this event please start a discussion.

UserAgent: the browser ID or other program that submitted the request

ccm: apparently <ca computer name>.<domain name>

Free Security Log Resources by Randy

• Free Security Log Quick Reference Chart
• Windows Event Collection: Supercharger Free Edtion
• Free Active Directory Change Auditing Solution
• Free Course: Security Log Secrets

Description Fields in 4889

• Disposition:

0	CR_DISP_INCOMPLETE	request did not complete
1	CR_DISP_ERROR	failed
2	CR_DISP_DENIED	denied
3	CR_DISP_ISSUED	issued
4	CR_DISP_ISSUED_OUT_OF_BAND	issued separately
5	CR_DISP_UNDER_SUBMISSION	taken under submission
6	CR_DISP_REVOKED	revoked

• SKI: subject key identifier
• Subject: the distinguished name of the subject of the certificate

Supercharger Free Edition

Supercharger's built-in Xpath filters leave the noise behind.

Free.

 

 

Upcoming Webinars Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources

•	Event IDs
•	All Event IDs
•	Audit Policy