Certificate-based authentication failing for domain-joined devices

The first error means the user account is not configured for smart card logon, the second one means the certificate chain used for authentication is no longer trusted by the local machine or domain. In a hybrid environment, this usually happens when certificate trust or mapping has drifted since initial setup.

To fix them, you need to verify the certificate chain (Ensure the full chain up to the root CA is present in trusted root certification authorities.) Check User Account Configuration (Confirm that the account is enabled for smart card logon and that the certificate is mapped (via UPN or altSecurityIdentities). If the certificate was reissued, you must update the mapping). Then validate CA Trust in the Domain, and check revocation settings (If the CRL expired, publish a new one from your CA).

If you find this information useful to some extent, don't forget to accept the answer so that your experience with the issue would help contribute to the whole community. Thank you :)

Vivian

Hi Anthony Montaleone,

Have you found the core issue yet? Please let me know if I can assist further.

Vivian

Good morning Anthony Montaleone,

Just want to know how it is going with your issue? Should you need more information, feel free to leave a message. Happy to help :)

Vivian

Hi,

How is your issue? If you require more details or assistance, don’t hesitate to send a message. Glad to support you!

VP