Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have observed some puzzling behavior from the CAs we have set up in both the past and present. For some reason unknown to us, it seems that our CAs are randomly issuing "Basic EFS" certificates to our users. This is evident through the "Issued Certificates" log on the CA. I personally set up a CA yesterday, and the instant that I installed certificate services it started dishing out Basic EFS certs to our users. They seem to be issued at random times: 1:51am, 2:20am, then 7:54am, then 8:03am... etc

I looked at the certificate template for Basic EFS and there isn't even an option for Autoenrollment, so I'm seriously in a state of "WTF?!"...

Can anyone clue me in as to why my CA has a mind of its own? Do CAs tend to become self-aware and lash out at their owners? Please help...


OK, so I did some digging and it appears that all users have Enroll permission. I highly doubt all these users are explicitly requesting these certificates. There must be some service running on their computers that is performing the Enroll. Can anyone verify this?

share|improve this question

Well, I think I found the answer all on my own. When users attempt to encrypt a file or folder, their computer looks for a certificate to perform the encryption with. If they do not have a valid certificate to encrypt with, their computer looks for a CA that will issue them Basic EFS certificate. If no CA exists, then their computer will create its own self-signed Basic EFS certificate.

I'm paraphrasing Microsoft's explanation, which can be found here.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.