Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two Active Directory domains in two separate forests, all at Windows Server 2008 R2 functional levels. There is a two-way forest trust between the domains.

Domain A contains a Windows Server 2008 R2 Enterprise Root Certification Authority; its root certificate is trusted by all computers in the domain; there are autoenrollment policies to automatically issue a computer certificate to each computer in the domain (more than one to DCs, as usual).

Domain B contains no Certification Authority, but the root certificate of Domain A's CA is assigned as a trusted root certificate to all computers in the domain via Group Policy, so any certificate issued by that CA is treated as valid.

Can I configure autoenrollment policies in Domain B so that each computer in Domain B automatically requests and obtains a certificate from the Certification Authority in Domain A?

If yes, how?

share|improve this question
up vote 2 down vote accepted

Cross forest enrollment can be accomplished by following the guide located at This copies the templates and security principals required to support AutoEnrollment.

Caveat: I have only used this to support Web Enrollment, so I have not personally verified that it can be pushed via group policy. That being said, if it can't, I know it can be done via a startup script that calls CertUtil.

share|improve this answer
Works perfectly, thanks. – Massimo Oct 23 '12 at 13:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.