Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In short, a Certificate Template I want to use is not available for enrollment.

The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this to work during testing, but on production the cert is not available. The only difference between the two is that the production environment was upgraded from a 2003 to 2008r2 forest functional level. No CA before the upgrade.

Here are the general steps I used on both setups (done with the Administrator account):

  1. Install the AD CS role (on a DC)
  2. Copy the RAS and IAS Server template.
  3. Rename to "Wireless Template" Assign RAS and IAS Servers permission to Enroll / Autoenroll.
  4. Enable "Wireless Template" on the CA Using mmc, enroll the Certificate to Local Certificates

Here's where it's inconsistent, on the lab server, the "Wireless Template" was available for enrollment. The production server gives me a permission denied message. I will admit that I may have missed some steps while trying to reproduce this on the production server. Both servers are 2008r2 enterprise, with the DC and NPS roles installed.


share|improve this question
You write "done with the Administrator account". A Domain Administrator account won't be enough, you need to make sure that the account is member of the Enterprise Administrator group. – Mathias R. Jessen Jun 2 '13 at 12:46
@MathiasR.Jessen, thanks for your answer.. The account is already part of the Enterprise Admins security group. – jaspher Jun 2 '13 at 18:28
up vote 1 down vote accepted

Solved! My server was not part of the RAS and IAS Servers security group..

share|improve this answer
You should mark your this as the accepted answer. – kce May 21 '14 at 16:49

You cannot request a computer certificate on a domain controller, you can only request the domain controller certificate and a couple others fyi

share|improve this answer
can you provide any evidence to back this up? – chicks Oct 29 '15 at 1:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.