I have an AD forest and one CA server. In the certificate template I have "Publish certificate in Active Directory" checkbox checked.
Also in the template, the Subject Name option is set to "Supply in the request". The certificates for all users is requested by a service account holding Enrollment Agent certificate.
The CN and SAN attributes in the certificate requests match that of the user object in AD DS.
However once the certificate is issued by the CA, it is getting published to the service account (the requestor) instead of actual user account.
Refer the last comment (dated May 17, 2018) in this thread - https://social.technet.microsoft.com/Forums/en-US/7c336ce5-9f7c-4713-9e27-8a59273b3182/how-does-the-ca-perform-this-quotpublish-certificate-in-active-directoryquot?forum=winserversecurity. I'm facing similar issue.
However, the accepted answer in above post states the certificate should have been published to the user account and not the service account. But the actual observed behavior is different.
Could somebody please guide how to fix this? Thanks.