I have installed 2 CA onto 2 Windows 2008R2 VM, one being an offline root CA and the other is intended to be the issuing CA. However I found that a DC (a 2008R2 VM) is requesting 2 certificates, namely Domain Controller Authentication and Directory Email Replication, (they are auto issued with expiration period of one year) on every reboot. I wonder if there is normal and would like to turn this 'feature' off, any idea?


Its normal for the DC to ask for a cert. It does this through autoenrollment. As long as the template is approved and the DC has the relevant permissions (read, enroll and autoenroll), it can autoenroll for a cert based on the template.

You could remove the template or edit the permissions if you dont want to issue it. Use the certificate management console as per http://technet.microsoft.com/en-us/library/cc772358.aspx to remove the template if you dont want to issue it.

  • Thank you very much for your info. I have disabled auto enrollment using group policy for domain controllers and wonder will there be any issue later without auto enrollment for the DC? – William Dec 20 '11 at 3:30
  • Don't disable autoenrollment. I personally would be more interested in troubleshooting why the same cert is requested over and over again. – maweeras Dec 20 '11 at 14:13
  • Since I think I need to do something to stop the unnecessary requests, I have disabled auto enrollment at the mean time. Just wonder, would it be related to forest functional level? I have 3 DC, 2x 2003R2 x86 and 1x 2008R2. It is the 2008R2 keeps requesting the certs regularly. In the long run, I am planning to replace those 2003R2 with 2008R2 and raise the domain/forest functional level to the highest level (now it is limited to 2003 native mode). – William Dec 23 '11 at 2:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.