neededwin10s

AccessingDoDEnterpriseEmail,AKO,andotherDoDwebsiteswithInternetExplorer&EdgeonyourWindowscomputerPerformingthesefixes"should"fixmostaccessproblems.
LastRevision/review:11July2020Presentedby:MichaelJ.
DanberryPersonnelutilizingthisguidewithoutaCACshouldonlyskipthepagesmarked:"ThispageisCACSpecific.
"CACholdersneedtofollowALLslides.
Themostuptodateversionofthispresentationcanbefoundat:https://milcac.
us/tweaks***2ndtolastslidewillprovideinformationonmultiPINpromptsinOWA***TosuccessfullyaccessDepartmentofDefense(DoD)websites,youMUSTinstalltheDoDcertificatesDownloadlinksandinstallationinstructionsfortheInstallRootfilecanbefoundon:https://militarycac.
com/dodcerts.
htmIfafterinstallationoftheDoDcertsyousee"Thereisaproblemwiththiswebsite'ssecuritycertificate"oryouseeredcertificateerrors,followthisguide:https://militarycac.
com/files/dodrootca2.
pdfOpenInternetExplorer(IE)[MakesurethepageyouarehavingproblemsaccessingisNOTopeninanytabsoranotherIEbrowser],SelectthegearYoumayalsoclickthe"Alt&T"keysonyourcomputerkeyboardWindows8/8.
1usersneedtousetheInternetExplorerontheDesktoptaskbar(bottomofscreen)NOTtheonefromtheStarttilesWindows10usersgotoslide5SelectInternetOptionsafterclickingthe'gear'Windows10users[usingEdgeinsteadofIE]needtotype"InternetOptions"inthe"Typeheretosearch"boxandselectInternetOptionsControlPanel.
Youmaynowskiptoslide7tocontinueYoucanalsoselectTools,InternetOptionsWhenusingEdgeinWindows10,select…(SettingsandMore),thenOpenwithInternetExplorerMoreChecktheDeletebrowsinghistoryonexit(box),clickDelete…NOTE:"Afew"IE11usershaveexperiencedproblemswhencheckingthisbox.
Checkthetop4boxes,leavetherestunchecked,clickDeleteClickSettingsChangethisnumberto50,clickOKNOTE:Thisismypersonalrecommendedsize.
Makingitsmallerwillmakeyourbrowserlookforanupdatedpagemoreoften.
Thelargeritis,themorewebsitesarebeingstoredonyourcomputer.
ClicktheSecurity(tab)(1),Trustedsites(greencheckmark)(2),thenSites(button)(3)123Removeallwebsites*thatendin.
milfromtheWebsites:(box)byclickingthelistedwebsite,selectingRemove,thenclickingCloseNOTE2:SomepeoplewillarguethatAKO"shouldbe"inthetrustedsites.
Here'swhatI'vebeenabletodeduce:itWASneededwithIE6&7,however,ifusingIE11,AKOuserswillbe"recycled"totheAKOhomepage.
So,IE11usersREMOVEit.
ThisistheWebsites:boxNOTE:MostGovernmentownedcomputerswillnotletyoumakechangestothisarea.
Youronlyoptionistoskipthisstep.
*-NOTE3:Asof13APR17,ifyouneedtheabilitytosendandreceiveencryptedemailinOWA,you'llneedtoaddhttps://*.
mail.
mil,moreinformationcanbereadintheURLherehttps://milcac.
us/files/win10smime.
pdfthencomebacktothisguideClicktheContent(tab),Certificates(button)Click:ClearSSLstateMostpeoplewillsee3-4DODcertificates(2withEMAILand1-2without)underthePersonal(tab)IssuedBy(column).
Personnelwith2CACs[andeverynewCACissuedsince25FEB2018]willsee4certificatesontheircard.
ThispageisCACSpecificClicktheIntermediateCertificationAuthorities(tab).
First,verifyyouhaveDODEMAILCA-33throughDODSWCA-61undertheIssuedTo(column)(ifyoudon't,gobacktoslide#2andinstallorreruntheDoDRootCertificatesagain).
Second,scrolldowntobelowtheDODIDSWCA-48andlookforallofthelistedcertificatesonthenextpage.
-CrossCertremoverAutomatedfile(youmayneedtorunasadministrator)toremovecertificatesListedabove(Doesnotalwayswork)DownloadfromMilitaryCAC(24OCT19version)DownloadfromCyber.
mil(24OCT19version)InformationabouttheCrossCertRemoverAnotherwaytoremovethecertificatesutilizingcertmgr.
mscThisguidecanbeusedifthemethodabovedoesn'tworkforyou.
IFyouseeanyofthecertificatesshownonthenextslide,selectit,andclickRemove.
Thesearetheknown"badcerts"thatneedtoberemovedfromIntermediateCertificationAuthorities(tab)[iffound]:IssuedToIssuedByDoDInteroperabilityRootCA1SHA-1FederalRootCAG2DoDInteroperabilityRootCA2FederalBridgeCA2013DoDInteroperabilityRootCA2FederalBridgeCA2016DoDRootCA2DoDInteroperabilityRootCA1DoDRootCA3DoDInteroperabilityFederalBridgeCA2016or2013FederalCommonPolicyCAFederalBridgeCAG4orG6FederalCommonPolicySHA-1FederalRootCAG2FederalCommonPolicyUSDoDCCEBInteroperabilityRootCA1NOTE:Ifyoudon'tseeanyofthese,selectCloseonthiswindowandcontinuewiththisguideClicktheConnections(tab)(1),LANsettings(button)(2),makesurenoneoftheboxesarechecked(3)(PersonalComputersonly),clickOK132ClicktheAdvanced(tab),scrolltothebottomofthelist,makesurethatonlyTLS1.
0,1.
1,&1.
2arechecked.
TheSSL(s)shouldNOTbecheckedNOTE:Windows10userswillnotseeUseSSL2.
0NOTE:"Some"computersrefusetoleaveTLS1.
0checkedandSSL2.
0unchecked.
Ifthishappens,clicktheReset…(button).
AnotherNOTE:Ifyouaregettinganerrormessageregarding"Cannotconnectsecurelytothispage"tryUNCheckingUseTLS1.
0Ifyouarestillhavingissues,uncheck"EnableEnhancedProtectedMode*"ThisissometimesneededtosignevaluationsonEES(Army'sOER/NCOERsystem).
https://evaluations.
hrc.
army.
milMoreinformationavailableathttps://MilitaryCAC.
com/ees.
htmINFORMATION:RunningEnhancedProtectedMode*helpspreventattackersfrominstallingsoftwareormodifyingsystemsettingsiftheymanagetorunexploitcode.
Itisanextralayerofprotectionthatlocksdownpartsofyoursystemthatyourbrowserordinarilydoesn'tneedtouse.
-Unfortunatelyitblocksaccessandfunctionalityto/onsomeDoDwebsiteslikeHRC'sEES.
Totrythisoption,ClickTools,InternetOptions,Advanced(tab)Ifthepreviousadjustmentsdidnotwork,selectReset…atthebottomoftheAdvanced(tab),ANDwhatyouseeonthenextpageYoumayneedtoRemovecertificates(seeslides5&13forinstructionsonhowtogettothislocation).
Peoplewith2CACsmayseeupto8certsaftertheyhaveactivatedtheirPIVcertificates(4certspercard).
NOTE2:Youwillreceiveamessagestating:Youcannotdecryptdataencryptedusingthecertificates.
Select:YesThispageisCACSpecificNOTE:RemovingcertsandyourCAC,thenreinsertyourCACisawaytotestifyourreaderandmiddlewareareworkingproperly.
Yourcertificates"should"automaticallybeavailabletoWindowswhenyouremoveandreinsertyourCACintothereader,however…IfyouhaveActivClient6.
2.
0.
x(Windows7)installed.
.
YoucandoubleclicktheActivClienticon(byyourclockinthelowerrightcornerofyourscreen)nowgotoslide26Ifyoudon'tseeitthere:Windows7userscanClickStart/Windowslogo,AllPrograms,ActivIdentity,ActivClient,UserConsole.
NowgotonextslideWindows7,8/8.
1,&10nativeuserswillnotseeanActivClienticon,sinceyouarenotusingit.
ActivClient7.
0.
x.
x.
&7.
1.
x.
xdonothavethefunctionofmakingavailabletowindows,youronlyoptionistoremovethecardandreinsertit.
ThispageisCACSpecificResettingoptimizationcacheinActivClient7.
1.
0.
xClickTools,Advanced,ResetoptimizationcacheThispageisCACSpecificForgetstateforallcardsinActivClient6.
2.
0.
x,thishelpsDualCACholdersimmediatelyafteraPIVactivationClickTools,Advanced,Forgetstateforallcards(twice)DOE.
JOHN.
ANDREW.
1111111111'sThispageisCACSpecificGotonextpagetoMakeCertificatesavailabletoWindowsMakeCertificatesavailabletoWindows.
.
.
ForgetstateforallcardsHowtomakeyourcertificatesavailabletoWindowswhenusingActivClient6.
2.
0.
xClickTools,Advanced,MakeCertificatesavailabletoWindowsDOE.
JOHN.
ANDREW.
1111111111'sThispageisCACSpecificYoushouldseethismessageTrytheseadditionalitemsifyouarestillhavingissues:Yourtimeonyourcomputermaybeoffbymorethantheserver's5minuteallowedlimit.
Checkyourclockandtimezone.
Ifallofthepreviousideasdidnotwork,pleasevisit:https://militarycac.
com/cacdrivers.
htmtostarttroubleshootingyourCACreaderWhencheckingyouremailonWindows10,makesureyouareselectingthecorrectcertificate.
SelectMorechoicestoseeadditionalcertificate(s)ThispageisCACSpecificTherehavebeenDNSissuesforsomepeople,pleasetrytheideasbelowifstillhavingproblemsHere'showinWindowstomanuallyconfiguretheDNSsettings.
1.
RightclickonyourWireless/Ethernetconnection(downbyyourclock)2.
SelectOpenNetworkandSharingCenter3.
ClickChangeAdapterSettings4.
RightClickonyouractiveinternetconnection,selectProperties5.
UnderThisconnectionusesthefollowingitems:scrolldownandclickonInternetProtocolVersion4(TCP/IPv4),thenclickProperties6.
SelecttheoptionUsethefollowingDNSserveraddresses:.
ThisiswhereyoumanuallyconfigureyourDNSservers:NOTE:ItisuptoyouifyouwanttouseOpenDNS,Quad9,orCloudflare.
Youmighttryeachofthemseparately.
Quad9-enter9.
9.
9.
9forPreferredDNSserver,andleavealternateDNSserverblank.
ClickOK,thenclickCloseorCloudflare–enter1.
1.
1.
1forPreferredDNSserver,and1.
0.
0.
1forAlternateDNS,ClickOK,thenclickCloseTherehavebeenDNSissuesforsomepeople,pleasetrytheideasbelowifstillhavingproblemsHere'sHowonaMactomanuallyconfiguretheDNSsettings.
1.
ClickAppleicon->SystemPreferences,Network.
2.
Selectthenetworkconnectionserviceyouwanttouse(usuallyWi-FiorEthernet,unlessyounameditsomethingelse)inthelist,thenclicktheAdvanced(button).
3.
ClicktheDNS(tab),clickthe(+)atthebottomoftheDNSServerslist.
ThisiswhereyouwilladdDNSserverIPaddresses.
NOTE:ItisuptoyouifyouwanttouseOpenDNSorQuad9.
Youmighttryeachofthemseparately.
Quad9-enter9.
9.
9.
9andleavealternateDNSblankorCloudflare–enter1.
1.
1.
1and1.
0.
0.
14.
Whenyou'refinished,clickOK,thenclosetheopenwindowNeverEndingPINpromptswhenusingInternetExploreraccessingOWAWhatIknow:1.
IamreceivingemailsfrompeopleintheArmyaccessing@mail.
mil,AirForceaccessing@us.
af.
mil,Navyaccessing@navy.
mil,andMarinesaccessing@usmc.
mil2.
IamalsoreceivingemailsfrompeopleusingbothWindowsandMaccomputers.
3.
TheyareallreceivingmanyPINpromptswhenusingInternetExplorer(IE)onWindows,andSafarionMaccomputers.
WhatItappearstome:ExchangeserverswerepushedasecuritypatchinearlyOctober2019.
Whatyoucando:1.
Ifyoudoneedencryption,useGoogleChrome,ORbereadytoenteryourPINbetween6-24timesbetweenactions.
Ihopeyoudon'tblockyourCACintheprocess2.
OnaWindowscomputer,lookforKB4519338anduninstallit.
Youcanonlyholdyourupdatesforamaxof7days.
Thiswillblockallsecurityupdates,makingyourcomputerunsecure.
Therefore,Idonotrecommendedthisoption.
3.
Afewpeoplehavereportedthatoncetheirmail.
milaccountwasmigratedtotheAuthenticationcertificatefromtheEmailcertificate,theynolongerareexperiencingthisissue.
4.
Callyourrespectivehelpdesksandletthemknow.
https://milcac.
us/questions.
htmPresentationcreatedandmaintainedby:MichaelJ.
Danberryhttps://MilitaryCAC.
comhttps://MilitaryCAC.
org(DoDComputers)Ifyoustillhavequestions,visit:https://militarycac.
com/questions.
htmhttps://militarycac.
org/questions.
htm(DoDComputers)