"The client certificate for the user "DOMAIN\user" is not valid, and resulted in a failed smartcard logon" after KB5005568 update.

Brian G 16

Running Windows Server 2019. In the early morning of Sept 16, 2021 this update auto-installed and restarted the server (September 14, 2021—KB5005568). Now, the event noted below has began to appear anytime a user signs in to their computer. None of our users use Smartcards, but we do run hybrid Azure AD with Windows Hello for Business enabled. Doesn't seem to be causing any issues, but I'd still like to know what the underlying issue is and correct it.

Any ideas?

Kerberos-Key-Distribution-Center
The client certificate for the user "DOMAIN\user" is not valid, and resulted in a failed smartcard logon. Please contact the user for more information about the certificate they're attempting to use for smartcard logon. The chain status was : A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.

Adrian Popovici 6 Reputation points

2021-09-29T07:32:18.95+00:00

II see the same behavior in my infrastructure as ell. Several domain controllers running Windows Server 2019, after being patched earlier this month this event started to pop up on each dc used by users. Also running hybrid Azure AD with WHfB. No recent changes to CA or GPOs.
No issue with users log on at the moment, but those warnings are messing with our monitoring.
brent24099 111 Reputation points

2021-09-29T13:13:56.097+00:00

Glad to here no issues with anything for you as well! But I would like to know why these are popping up for sure. Don't want them to become failures down the road.
Brian G 16 Reputation points

2021-09-29T16:33:57.797+00:00

Agreed. I would have normally posted on TechNet, but it seems that platform has been discontinued... although somehow users are still posting their questions. I'm wondering if the Microsoft techs ignore this platform since none of them have responded. So very disappointing.
Adrian Popovici 6 Reputation points

2021-10-18T15:55:58.513+00:00

Did anyone find any kind of solution to this?
I was waiting to see if maybe some hotfix would be released during last week's Patching Tuesday, installed all the updates on our servers last weekend, but I still see the warnings in the logs of all domain controllers hit by authentication requests.
Brian G 16 Reputation points

2021-10-19T14:59:55.067+00:00

I'm still having the same issue as well. Very frustrating.
windingo 1 Reputation point

2021-10-25T12:11:49.31+00:00

I see the same behavior here. I added a Server 2022 DC within the last days, but it looks like this was not the source of the issue.
Allister PHILIPPE 6 Reputation points

2021-10-25T14:35:27.7+00:00

Hello,
I hame the same problem on my 2016 DC. IT's linked to a certificate for Windows HEllo for Business.
At the initialization of Hello, a certificate (public one) is generated and put on the personal certificate store of the user. The problem is, the Root CA for this certificate is not present, and we don't know which Root CA is.

the way i found to solve the warning is to put the certificate (issued for hello from a public certificate) (in my screenshot), into the Trusted Root Certificate Authorities in the user part.
Allister PHILIPPE 6 Reputation points

2022-01-27T10:46:21.857+00:00

Hello,

Some news about this issue. I open a case to Microsoft some time ago, after providing some logs, the product group has been notify about the "issue".
It seems related to an update, a rare condition. I keep you informed when i have more information.

17 answers

Doug Tran 6 Reputation points

2021-11-17T17:29:00.67+00:00

Confirmed, no joy, still seeing errors. I still think it's related to Secure Hardware Key which we don't use.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Doug Tran 6 Reputation points

2021-11-18T19:35:43.167+00:00
For users seeing this issue:

Do you have Password-less FIDO2 Security enabled?

If you do, do you see this error if you logged in with a Security Key vs a Password?

Do you see this error if you log into a Windows Servers vs Windows 10?

If so, look at this these two pages:

https://learn.microsoft.com/en-us/windows-server/security/kerberos/whats-new-in-kerberos-authentication#domain-joined-device-support-for-authentication-using-public-key

https://learn.microsoft.com/en-us/windows-server/security/kerberos/domain-joined-device-public-key-authentication#domain-joined-device-authentication-using-public-key

For myself, I enabled FIDO2 back in Feburary 2021. I do not see this event when logging in with a Security Key. I do not see this event when logging into a Windows Server via password.

-Doug
Please sign in to rate this answer.
Brian G 16 Reputation points

2021-11-18T19:57:28.693+00:00

We don't use security keys. The events are generated only when our users sign in via WHfB (PIN, Facial Recognition, etc.). The event is not generated if they sign in with a password... which they rarely do, thus the plethora of events being recorded.

winsol 1 Reputation point

2021-11-18T20:12:16.103+00:00

I also get them for computer accounts for some reason, but only for a couple of servers.

The client certificate for the user DOMEAIN\COMPUTER$ is not valid, and resulted in a failed smartcard logon. Please contact the user for more information about the certificate they're attempting to use for smartcard logon. The chain status was : A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Sign in to comment
Anonymous

2021-11-24T14:31:49.68+00:00

Hey everyone, I have the same issue but we use AADJ devices. Furthermore we see in CAPI2 log:

Subject name is:

Do you have an idea what is wrong?

Best regards
Please sign in to rate this answer.

0 comments No comments
Sign in to comment
Shaunm001 301 Reputation points

2022-01-11T15:26:06.457+00:00

It's definitely Windows Hello for Business related, we started seeing these error messages as soon as we began implementing WHfB (Hybrid Azure AD Key-Trust deployment) a couple months ago. It does seem to drop this self-signed certificate onto every machine where a user has enabled WHfB. WHfB is functioning normally for everyone, not sure if this is just one of those "by-design" errors you can safely ignore or if we botched the rollout at some point.

I tried deleting the cert and rebooting and was still able to sign in using my WHfB PIN. I checked certificates again after logging back in and saw that a new self-signed cert had been added back in. I next tried moving the cert into the Trusted Root store, rebooted and signed back in. When I checked certificates again, it had once more added the self-signed cert back into the personal store. This time it didnt show any errors about being untrusted, but I still got a Kerberos KDC event 21 error on the domain controller for that sign in. Not sure what to do at this point, other than ignore these errors...?
Please sign in to rate this answer.
Shane Foley 1 Reputation point

2022-01-25T00:23:52.013+00:00

Hi there,
we too are seeing the same log entries for our Azure only joined devices.

I've been directed by my manager to log a ticket with MS just to confirm that these can be safely ignored.

I'll update this thread with whatever MS come back with.

Michael Bast 1 Reputation point

2022-07-05T08:35:50.5+00:00

Any Updates @Shane Foley ?
Sign in to comment
Mads Brodersen Toustrup 1 Reputation point

2022-04-12T12:34:47.003+00:00

Did anyone find a solution for this, or did you choose to ignore the warning messages?
I can confirm that everything works fine - but as more and more users start using WHfB this will flood the logs ... :-)
Please sign in to rate this answer.
Adrian Popovici 6 Reputation points

2022-04-12T12:48:57.947+00:00

No solution that I am aware of, yet.
I think all of us went with successfully ignoring it - until it will miraculously and automagically disappear from the logs :)

Doug Tran 6 Reputation points

2022-07-05T12:46:22.557+00:00

There were several people who had opened a case with MS but I don't recall receiving a follow-up. After my experience with MS support lately, I have no expectations we will get one.
Sign in to comment