"The client certificate for the user "DOMAIN\user" is not valid, and resulted in a failed smartcard logon" after KB5005568 update.

Brian G 16 Reputation points
2021-09-22T15:35:25.277+00:00

Running Windows Server 2019. In the early morning of Sept 16, 2021 this update auto-installed and restarted the server (September 14, 2021—KB5005568). Now, the event noted below has began to appear anytime a user signs in to their computer. None of our users use Smartcards, but we do run hybrid Azure AD with Windows Hello for Business enabled. Doesn't seem to be causing any issues, but I'd still like to know what the underlying issue is and correct it.

Any ideas?

Kerberos-Key-Distribution-Center
The client certificate for the user "DOMAIN\user" is not valid, and resulted in a failed smartcard logon. Please contact the user for more information about the certificate they're attempting to use for smartcard logon. The chain status was : A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,720 questions

17 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. cthivierge 4,056 Reputation points
    2021-09-22T17:55:01.287+00:00

    If you enable CAPI2 log on the client computer and set the size of the log to at least 4096K
    Then ask a user to login using his smartcard
    Look for errors in the CAPI2 log.

    CAPI2 log
    Event Viewer / Applications and Services Logs / Microsoft / Windows / CAPI2

    It may give you more information

    0 comments
  2. Brian G 16 Reputation points
    2021-09-22T18:16:07.22+00:00

    These three ERRORS are being recorded several times for several different [ProcessName]'s.

    Result The revocation function was unable to check revocation for the certificate.
    [ value] 80092012

    Result The certificate is not valid for the requested usage.
    [ value] 800B0110

    Result A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
    [ value] 800B0109

    0 comments
  3. cthivierge 4,056 Reputation points
    2021-09-22T20:22:26.403+00:00

    That there is no changes in your internal PKI ?

    Can you validate that there is no issuing CA in the trusted root store ?
    You can validate using this PS command:
    Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject}

  4. Brian G 16 Reputation points
    2021-09-22T20:41:57.6+00:00

    First... thank you for your help.

    I ran the command (I needed to add underscore after $). It didn't appear to do anything and returned me to the command prompt.

    PS C:\Users\Administrator> Get-Childitem cert:\LocalMachine\root -Recurse | Where-Object {$.Issuer -ne $.Subject}
    PS C:\Users\Administrator>

    0 comments
  5. Limitless Technology 39,351 Reputation points
    2021-09-23T09:36:24.893+00:00

    Hello @Brian G ,

    In fact this new updates have changed how the Key authentication works.

    There was a previous thread on this topic, where a community member created an article for a workaround this behavior:

    https://social.technet.microsoft.com/Forums/en-US/4fd818f0-c72a-409c-8ef5-8717d02f4666/windows-hello-intune-mdm-aad-hybrid-ad-kb3200970-amp-kb3199986-pin-login-failure?forum=win10itprosecurity

    Hope this also helps in your case,

    ----------------------------------------------------------------------------------------------------------------------

    --If the reply is helpful, please Upvote and Accept as answer--

    0 comments