I have this AD domain where a Windows Server 2003 SP2 Enterprise Root Certification Authority is operational, and certificate autoenrollment is enabled both for users and computers; all fine and good, every domain-joined computer automatically gets a Computer certificate issued. There are also two Windows Server 2003 SP2 domain controllers, which instead received a Domain Controller certificate; all fine and good, again.
Then I got a Windows Server 2008 R2 SP1 member server, which had already automatically enrolled a Computer certificate, and promoted it to domain controller. It didn't get any new one after the promotion, and no errors are logged anywhere: it looks like it simply decided that, having already a working certificate, it didn't need a new one.
What I want to know is:
- Is there actually any difference between the Computer certificate template and the Domain Controller one?
- Does it make any difference if a domain controller has one of the formers instead of one of the latters?
- How can I force this domain controller to autoenroll a new certificate of the correct type for its role?
Edit:
I tried revoking the existing certificate and rebooting the new DC; nothing happened. Then I removed the existing certificate from the DC's local store and rebooted it again; nothing heppened this time, too.
Edit:
I turned on autoenrollment logging, and I found there actually are some errors... when the new DC tries to enroll a certificate, it logs a bunch of errors:
- Event ID 56: "Certificate enrollment for Local system for the template DomainController was not performed because this templte has been suerseded."
- Event ID 46: "Certificate enrollment for Local system could not enroll for a Machine certificate. Read or enrollment access is not allowed for this template."
- Event ID 47: "Certificate enrollment for Local system could not enroll for a DirectoryEmailReplication certificate. A valid certification authority cannot be found to issue this template."
- Event ID 47: "Certificate enrollment for Local system could not enroll for a DomainControllerAuthentication certificate. A valid certification authority cannot be found to issue this template."
- Event ID 47: "Certificate enrollment for Local system could not enroll for a KerberosAuthentication certificate. A valid certification authority cannot be found to issue this template."