Certificates snap-in VPN, IAS, or NPS server, non-domain member Computer Server Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive VPN server with connection, member Computer Server Authentication and Client Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive Client running Windows Vista or Windows XP, member Computer Client Authentication CA Web enrollment tool Install from a floppy disk or portable USB drive User, domain user User Client Authentication Autoenrollment Use a smart card or the CA Web enrollment tool If your enterprise CA is on a computer running one of the following operating systems, the RAS and IAS Servers and Workstation Authentication templates are available for use: Windows Server 2003, Enterprise Edition Windows Server 2003, Datacenter Edition Windows Server 2003, Enterprise Edition for Itanium-based Systems Windows Server 2003, Datacenter Edition for Itanium-based Systems Windows Server 2003, Enterprise x64 Edition Windows Server 2003, Datacenter x64 Edition Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2012 R2 Use the following table to determine when to use these templates. Object and domain membership Certificate template Certificate purpose Preferred certificate enrollment method Alternate certificate enrollment method VPN, IAS, or NPS server, domain member RAS and IAS Server Server Authentication Autoenrollment a certificate by using the Certificates
^ Matches the beginning of the input or line. $ Matches the end of the input or line. * Matches the preceding character zero or more times. /zo*/ matches either "z" or "zoo." + Matches the preceding character one or more times. /zo+/ matches "zoo" but not "z." ? Matches the preceding character zero or one times. /a?ve?/ matches the "ve" in "never." . Matches any single character except a newline character. ( pattern ) Matches pattern and remembers the match. To match ( ) (parentheses), use "\(" or "\)". x | y Matches either x or y. /z|food?/ matches "zoo" or "food." { n } Matches exactly n times (n is a nonnegative integer). /o{2}/ does not match the "o" in "Bob," but matches the first two instances of the letter o in "foooood." { n ,} Matches at least n times (n is a nonnegative integer). /o{2,}/ does not match the "o" in "Bob" but matches all of the instances of the letter o in "foooood." /o{1,}/ is equivalent to /o+/. { n , m } Matches at least n and at most m times (m and n are nonnegative integers). /o{1,3}/ matches the first three instances of the letter o in "fooooood." [ xyz ] Matches any one of the enclosed characters (a character set). /[abc]/ matches the "a" in "plain." [^ xyz ] Matches any characters that are not enclosed (a negative character set). /[^abc]/ matches the "p" in "plain." \b Matches a word boundary (for example, a space). /ea*r\b/ matches the "er" in "never early." \B Matches a nonword boundary. /ea*r\B/ matches the "ear" in "never early." \d Matches a digit character (equivalent to [0-9]). \D Matches a nondigit character (equivalent to \f Matches a form feed character. \n Matches a line feed character. \r Matches a carriage return character.
The Data type column identifies the data type (text, number, or time) for each attribute. When you create a database into which log files are imported, you must define each field for the data type of the attribute value that will be imported into it. In log files, text values (such as strings, octet strings, and IP addresses) are always surrounded by double quotes. If the double quotes appear within the string, then they are replaced with a double set of double quotes. This table shows the values for the example entries of an IAS-internal attribute. Value shown in example Attribute Data type Description Text The name of the server where the packet was received (this is an IAS-internal attribute). "IAS" ServiceName Text The name of the service that generated the or the Routing and Remote Access service (this is an IAS-internal attribute). 03/07/2008 Record-Date Time The date at the NPS or Routing and Remote Access server (this is an IAS-internal attribute). 13:04:33 Record-Time Time The time at the NPS or Routing and Remote Access server (this is an IAS-internal attribute). 1 Packet-Type The type of packet, which can be: 1 = Access-Request 2 = Access-Accept 3 = Access-Reject 4 = Accounting-Request This is an IAS-internal attribute. "client" User-Name Text The user identity, as specified by the user. Text The user name in canonical format (this is an attribute). Text The phone number dialed by the user. Text The phone number from which the call originated. Text The callback phone number. Text The framed address to be configured for the user.
To enable remote access account lockout Set the MaxDenials entry in the registry to 1 or greater. MaxDenials is the maximum number of failed attempts before the account is locked out. By default, MaxDenials is set to 0, which means that remote access account lockout is disabled. To modify the amount of time before the failed attempts counter is reset Set the ResetTime (mins) entry in the registry to the required number of minutes. By default, ResetTime (mins) is set to 0xb40, or 2,880 minutes (48 hours). To manually reset a user account that has been locked out before the failed attempts counter is automatically reset Delete the following registry entry that corresponds to the user’s account name: name:user name When the lockout count for a user account is reset to 0 due to either a successful authentication or an automatic reset, the registry subkey for the user account is deleted. NPS CRL Check Registry Settings You can use the following registry settings to change the way Network Policy Server (NPS) performs certificate revocation list (CRL) checks when EAP-TLS is used. Caution Incorrectly editing the registry can severely damage your system. Before making changes to the registry, you should back up any valued data on the computer. All of the listed registry settings can be configured on NPS servers with the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP\EAP\13 Important All of the following registry settings must be added as a DWORD type and have the valid values of 0 or 1.