Windows Security Log Event ID 4888
4888: Certificate Services denied a certificate request
On this page
This event is logged if either:
- An administrator or other certificate manager denies a pending request. This event 4888 is logged in addtion to 4868. It may even be logged twice with 4868 in between.
- The Certification Authority itself denies the request based on policy.
This event event is only logged if "Issue and manage certificate requests" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.
Free Security Log Resources by Randy
- Request ID: To get the details on the request including who requested it you will need to look in the log for other events with the same Request ID.
- Requester: the account that requested the certificate
- Attributes: unknown. if you have information to share on this event please start a discussion.
- ccm: apparently <ca computer name>.<domain name>
- Disposition:
| 0 |
CR_DISP_INCOMPLETE |
request did not complete |
| 1 |
CR_DISP_ERROR |
failed |
| 2 |
CR_DISP_DENIED |
denied |
| 3 |
CR_DISP_ISSUED |
issued |
| 4 |
CR_DISP_ISSUED_OUT_OF_BAND |
issued separately |
| 5 |
CR_DISP_UNDER_SUBMISSION |
taken under submission |
| 6 |
CR_DISP_REVOKED |
revoked |
- SKI: subject key identifier
- Subject: the distinguished name of the subject of the certificate
Setup PowerShell Audit Log Forwarding in 4 Minutes