How to enable diagnostic debug logging of Certificate Services

You can enable diagnostic debug logging of Certificate Services on Windows Server 2003-based servers by modifying the registry on the computer on which the logging is to occur.

KB article: 299621

Value Path: HKLM\SYSTEM\CurrentControlSet\Services\Certsvc\Configuration\
Value Name: debug
Value Type: REG_DWORD
Value Data: FFFFFFFF (hex)
Output: %systemroot%\certsrv.log
Note: To turn logging off, delete the preceding debug registry value.
The affected log files are: -
- %Systemroot%\certsrv.log (Certsrv.exe) Certificate Services
- %SystemRoot%\certutil.log (Certutil.exe)
- %SystemRoot%\certreq.log (Certreq.exe)
- %SystemRoot%\certmmc.log (Certmmc.dll) Certificate Services MMC snap-in
- %SystemRoot%\certocm.log (Certocm.dll) Certificate Services Setup