Windows Security Log Event ID 4888

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Windows Server 2019 and 2022
Category
 • Subcategory		Object Access
 • Certification Services
Type Failure
Corresponding events
in Windows 2003
and before		  
Discussions on Event ID 4888
Ask a question about this event

4888: Certificate Services denied a certificate request

On this page

This event is logged if either:

    • An administrator or other certificate manager denies a pending request.  This event 4888 is logged in addtion to 4868.  It may even be logged twice with 4868 in between.
    • The Certification Authority itself denies the request based on policy.

This event event is only logged if "Issue and manage certificate requests" is enabled on the Audit tab of the CA's properties in Certificate Services MMC snap-in and of course if the Certificate Services audit subcategory is enabled with auditpol.

Free Security Log Resources by Randy

Description Fields in 4888

  • Request ID: To get the details on the request including who requested it you will need to look in the log for other events with the same Request ID.
  • Requester: the account that requested the certificate
  • Attributes:  unknown.  if you have information to share on this event please start a discussion.
  • ccm: apparently <ca computer name>.<domain name> 
  • Disposition:

0 CR_DISP_INCOMPLETE request did not complete
1 CR_DISP_ERROR failed
2 CR_DISP_DENIED denied
3 CR_DISP_ISSUED issued
4 CR_DISP_ISSUED_OUT_OF_BAND issued separately
5 CR_DISP_UNDER_SUBMISSION taken under submission
6 CR_DISP_REVOKED revoked

  • SKI: subject key identifier
  • Subject: the distinguished name of the subject of the certificate

Supercharger Enterprise


Load Balancing for Windows Event Collection

 

Examples of 4888

Certificate Services denied a certificate request.

Request ID: 6
Requester: ACME-FR\administrator
Attributes:
Disposition: 2
SKI:  86 00 7d 5e 4a a0 a9 73 d1 28 3c a5 48 57 19 05 b7 e8 cb 44
Subject:

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



Mini-Seminars Covering Event ID 4888
Discussions on Event ID 4888
Ask a question about this event

 

Upcoming Webinars
Additional Resources