In short, a Certificate Template I want to use is not available for enrollment.

The template in question is a copy of the "RAS and IAS Server" template. What's frustrating is that I've gotten this to work during testing, but on production the cert is not available. The only difference between the two is that the production environment was upgraded from a 2003 to 2008r2 forest functional level. No CA before the upgrade.

Here are the general steps I used on both setups (done with the Administrator account):

  1. Install the AD CS role (on a DC)
  2. Copy the RAS and IAS Server template.
  3. Rename to "Wireless Template" Assign RAS and IAS Servers permission to Enroll / Autoenroll.
  4. Enable "Wireless Template" on the CA Using mmc, enroll the Certificate to Local Certificates

Here's where it's inconsistent, on the lab server, the "Wireless Template" was available for enrollment. The production server gives me a permission denied message. I will admit that I may have missed some steps while trying to reproduce this on the production server. Both servers are 2008r2 enterprise, with the DC and NPS roles installed.


  • 1
    You write "done with the Administrator account". A Domain Administrator account won't be enough, you need to make sure that the account is member of the Enterprise Administrator group. – Mathias R. Jessen Jun 2 '13 at 12:46
  • @MathiasR.Jessen, thanks for your answer.. The account is already part of the Enterprise Admins security group. – jaspher Jun 2 '13 at 18:28

You cannot request a computer certificate on a domain controller, you can only request the domain controller certificate and a couple others fyi


Solved! My server was not part of the RAS and IAS Servers security group..

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.