I have this AD domain where a Windows Server 2003 SP2 Enterprise Root Certification Authority is operational, and certificate autoenrollment is enabled both for users and computers; all fine and good, every domain-joined computer automatically gets a Computer certificate issued. There are also two Windows Server 2003 SP2 domain controllers, which instead received a Domain Controller certificate; all fine and good, again.

Then I got a Windows Server 2008 R2 SP1 member server, which had already automatically enrolled a Computer certificate, and promoted it to domain controller. It didn't get any new one after the promotion, and no errors are logged anywhere: it looks like it simply decided that, having already a working certificate, it didn't need a new one.

What I want to know is:

  • Is there actually any difference between the Computer certificate template and the Domain Controller one?
  • Does it make any difference if a domain controller has one of the formers instead of one of the latters?
  • How can I force this domain controller to autoenroll a new certificate of the correct type for its role?


I tried revoking the existing certificate and rebooting the new DC; nothing happened. Then I removed the existing certificate from the DC's local store and rebooted it again; nothing heppened this time, too.


I turned on autoenrollment logging, and I found there actually are some errors... when the new DC tries to enroll a certificate, it logs a bunch of errors:

  • Event ID 56: "Certificate enrollment for Local system for the template DomainController was not performed because this templte has been suerseded."
  • Event ID 46: "Certificate enrollment for Local system could not enroll for a Machine certificate. Read or enrollment access is not allowed for this template."
  • Event ID 47: "Certificate enrollment for Local system could not enroll for a DirectoryEmailReplication certificate. A valid certification authority cannot be found to issue this template."
  • Event ID 47: "Certificate enrollment for Local system could not enroll for a DomainControllerAuthentication certificate. A valid certification authority cannot be found to issue this template."
  • Event ID 47: "Certificate enrollment for Local system could not enroll for a KerberosAuthentication certificate. A valid certification authority cannot be found to issue this template."

Try certutil -pulse - this should check for templates the system has permission in, and enroll them. It should have no problem grabbing the certificate, as long as there's nothing crazy going on in the permissions settings on the template.

You'll definitely want to have your DCs have a Domain Controller-style certificate (Domain Controller is the old one; Domain Controller Authentication then Kerberos Authentication supersede it; if your CA is running enterprise edition, then consider switching to the newer Kerberos template) - while a lot of the functions that it satisfies will be handled by a Computer certificate, some of the DC-specific stuff like smart card authentication, the LDAP/SSL listener (I believe?), and with the newer Kerberos certificate, strong KDC validation, need the special certificate.

  • Tried, and also tried to update policies and reboot server. Everytime it doesn't work and I get some errors logged (after enabling autoenrollment logging); see the edit for details. – Massimo Jul 21 '11 at 15:28
  • Oh, well then none of your DCs are getting a new one - they'll all expire out eventually! Someone's set the Kerberos Authentication or Domain Controller Authentication template to supersede the Domain Controller template, so no more of the old type will be issued, but there's no CA in the domain configured to issue the newer types. – Shane Madden Jul 21 '11 at 15:58
  • And how could this have happened?!? The CA was perfectly fine before adding the 2008 R2 DC to the domain... is this something that can happen when upgrading AD to 2008 R2? – Massimo Jul 21 '11 at 17:16
  • As far as I'm aware, superseded template configuration is not done by default - but, I don't have a domain handy with no R2 DCs that I can add one in to verify, unfortunately. – Shane Madden Jul 21 '11 at 17:33
  • I migrated the CA to Windows Server 2008 R2, and now everything is working. Anyway, "certutil -pulse" was definitely the right answer, so I'm acceptinng it :-) – Massimo Jul 22 '11 at 9:00

Did you try removing the certificate from the server itself, instead of simply publishing the revocation to the revocation list on the CA? Then have the server enroll (request a certificate) again?

Here's some info on the certificates: http://technet.microsoft.com/en-us/library/cc787009(WS.10).aspx

  • Yes, tried removing the certificate, too. Now the server doesn't have any certificate. And yet, it's still not requesting a new one. – Massimo Jul 21 '11 at 14:40
  • Well, looks like it's actually trying to request it, but fails. – Massimo Jul 21 '11 at 15:28
  • Refer to eventid.net for more info on event log entries and this: technet.microsoft.com/en-us/library/dd299884(WS.10).aspx – mbrownnyc Jul 21 '11 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.