deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-18 16:27:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Acrolinx improvements

Browse Source
This commit is contained in:
Daniel Simpson 2020-07-21 12:45:36 -07:00
parent d0d95e8a6c
commit 85659a6587
1 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
windows/security/identity-protection/smart-cards/smart-card-debugging-information.md
View File

@ -1,12 +1,12 @@
--- ---
title: Smart Cards Debugging Information (Windows 10) title: Smart Card Troubleshooting (Windows 10)
description: This topic explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. description: Describes the tools and services that smart card developers can use to help identify certificate issues with the smart card deployment.
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
ms.sitesec: library ms.sitesec: library
ms.pagetype: security ms.pagetype: security
audience: ITPro audience: ITPro
author: dulcemontemayor author: dansimp
ms.author: dansimp ms.author: dansimp
manager: dansimp manager: dansimp
ms.collection: M365-identity-device-management ms.collection: M365-identity-device-management
@ -16,11 +16,11 @@ ms.date: 04/19/2017
ms.reviewer: ms.reviewer:
--- ---
# Smart Cards Debugging Information # Smart Card Troubleshooting
Applies To: Windows 10, Windows Server 2016 Applies To: Windows 10, Windows Server 2016
This topic explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment. This article explains tools and services that smart card developers can use to help identify certificate issues with the smart card deployment.
Debugging and tracing smart card issues requires a variety of tools and approaches. The following sections provide guidance about tools and approaches you can use. Debugging and tracing smart card issues requires a variety of tools and approaches. The following sections provide guidance about tools and approaches you can use.
@ -28,7 +28,7 @@ Debugging and tracing smart card issues requires a variety of tools and approach
- [Debugging and tracing using WPP](#debugging-and-tracing-using-wpp) - [Debugging and tracing using WPP](#debugging-and-tracing-using-wpp)
- [Kerberos protocol, KDC and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing) - [Kerberos protocol, KDC, and NTLM debugging and tracing](#kerberos-protocol-kdc-and-ntlm-debugging-and-tracing)
- [Smart Card service](#smart-card-service) - [Smart Card service](#smart-card-service)
@ -56,7 +56,7 @@ To delete a container, type **certutil -delkey -csp "Microsoft Base Smart Card C
## Debugging and tracing using WPP ## Debugging and tracing using WPP
Windows software trace preprocessor (WPP) simplifies tracing the operation of the trace provider, and it provides a mechanism for the trace provider to log real-time binary messages. Logged messages can subsequently be converted to a human-readable trace of the operation of the trace provider. For more information about WPP, see [Diagnostics with WPP - The NDIS blog](https://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx). Windows software trace preprocessor (WPP) simplifies tracing the operation of the trace provider. It provides a mechanism for the trace provider to log real-time binary messages. Logged messages can be converted to a human-readable trace of the operation. For more information, see [Diagnostics with WPP - The NDIS blog](https://blogs.msdn.com/b/ndis/archive/2011/04/06/diagnostics-with-wpp.aspx).
### Enable the trace ### Enable the trace
@ -112,13 +112,13 @@ To stop a trace:
<!-- It's difficult to find any Kerberos content any more. If they reinstate some content that's more relevant and detailed than what's below, link to it instead. --> <!-- It's difficult to find any Kerberos content any more. If they reinstate some content that's more relevant and detailed than what's below, link to it instead. -->
You can use the following resources to begin troubleshooting these protocols and the KDC: You can use these resources to troubleshoot these protocols and the KDC:
- [Kerberos and LDAP Troubleshooting Tips](https://technet.microsoft.com/library/bb463167.aspx) - [Kerberos and LDAP Troubleshooting Tips](https://technet.microsoft.com/library/bb463167.aspx)
- [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit)  You can use the trace log tool in this SDK to debug Kerberos authentication failures. - [Windows Driver Kit (WDK) and Debugging Tools for Windows (WinDbg)](https://developer.microsoft.com/en-us/windows/hardware/windows-driver-kit)  You can use the trace log tool in this SDK to debug Kerberos authentication failures.
To begin tracing, you can use Tracelog. Different components use different control GUIDs as explained in the following examples. For more information, see [Tracelog](https://msdn.microsoft.com/library/windows/hardware/ff552994.aspx). To begin tracing, you can use Tracelog. Different components use different control GUIDs as explained in these examples. For more information, see [Tracelog](https://msdn.microsoft.com/library/windows/hardware/ff552994.aspx).
### NTLM ### NTLM
@ -126,17 +126,17 @@ To enable tracing for NTLM authentication, run the following at the command line
tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1 tracelog.exe -kd -rt -start ntlm -guid \#5BBB6C18-AA45-49b1-A15F-085F7ED0AA90 -f .\\ntlm.etl -flags 0x15003 -ft 1
To stop tracing for NTLM authentication, run the following at the command line: To stop tracing for NTLM authentication, run this command:
tracelog -stop ntlm tracelog -stop ntlm
### Kerberos authentication ### Kerberos authentication
To enable tracing for Kerberos authentication, run the following at the command line: To enable tracing for Kerberos authentication, run this command:
tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1 tracelog.exe -kd -rt -start kerb -guid \#6B510852-3583-4e2d-AFFE-A67F9F223438 -f .\\kerb.etl -flags 0x43 -ft 1
To stop tracing for Kerberos authentication, run the following at the command line: To stop tracing for Kerberos authentication, run this command:
tracelog.exe -stop kerb tracelog.exe -stop kerb
@ -150,7 +150,7 @@ To stop tracing for the KDC, run the following at the command line:
tracelog.exe -stop kdc tracelog.exe -stop kdc
To stop tracing from a remote computer, run the following at the command line: logman.exe -s *&lt;ComputerName&gt;*. To stop tracing from a remote computer, run this command: logman.exe -s *&lt;ComputerName&gt;*.
> **Note**&nbsp;&nbsp;The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name. > **Note**&nbsp;&nbsp;The default location for logman.exe is %systemroot%system32\\. Use the **-s** option to supply a computer name.
@ -166,7 +166,7 @@ You can also configure tracing by editing the Kerberos registry values shown in
If you used Tracelog, look for the following log file in your current directory: kerb.etl/kdc.etl/ntlm.etl. If you used Tracelog, look for the following log file in your current directory: kerb.etl/kdc.etl/ntlm.etl.
Otherwise, if you used the registry key settings shown in the previous table, look for the generated trace log files in the following locations: If you used the registry key settings shown in the previous table, look for the trace log files in the following locations:
- NTLM: %systemroot%\\tracing\\msv1\_0 - NTLM: %systemroot%\\tracing\\msv1\_0
@ -178,7 +178,7 @@ To decode event trace files, you can use Tracefmt (tracefmt.exe). Tracefmt is a
## Smart Card service ## Smart Card service
The smart card resource manager service runs in the context of a local service, and it is implemented as a shared service of the services host (svchost) process. The smart card resource manager service runs in the context of a local service. It's implemented as a shared service of the services host (svchost) process.
**To check if Smart Card service is running** **To check if Smart Card service is running**
@ -202,7 +202,7 @@ The smart card resource manager service runs in the context of a local service,
You can use the following command at the command prompt to check whether the service is running: **sc queryex scardsvr**. You can use the following command at the command prompt to check whether the service is running: **sc queryex scardsvr**.
The following is example output from running this command: This is an example output from this command:
``` ```
SERVICE_NAME: scardsvr SERVICE_NAME: scardsvr
@ -236,9 +236,9 @@ As with any device connected to a computer, Device Manager can be used to view p
## CryptoAPI 2.0 Diagnostics ## CryptoAPI 2.0 Diagnostics
CryptoAPI 2.0 Diagnostics is a feature that is available in Windows operating systems that supports CryptoAPI 2.0. This feature can help you troubleshoot public key infrastructure (PKI) issues. CryptoAPI 2.0 Diagnostics is available in Windows versions that support CryptoAPI 2.0 and can help you troubleshoot public key infrastructure (PKI) issues.
CryptoAPI 2.0 Diagnostics logs events in the Windows event log, which contain detailed information about certificate chain validation, certificate store operations, and signature verification. This information makes it easier to identify the causes of issues and reduces the time required for diagnosis. CryptoAPI 2.0 Diagnostics logs events in the Windows event log. The logs contain detailed information about certificate chain validation, certificate store operations, and signature verification. This information makes it easier to identify the causes of issues and reduces the time required for diagnosis.
For more information about CryptoAPI 2.0 Diagnostics, see [Troubleshooting an Enterprise PKI](https://technet.microsoft.com/library/cc771463.aspx). For more information about CryptoAPI 2.0 Diagnostics, see [Troubleshooting an Enterprise PKI](https://technet.microsoft.com/library/cc771463.aspx).