I am trying to enable certificate autoenrollment and credential roaming through a GPO in an ADS domain (DCs are Windows Server 2008 R2). I can interactively log on as a newly created user (on a member server, Windows Server 2012), and the policy is applied to that user. However, when an identically created new user logs on as a service identity, the GPO is not applied, as I can confirm by inspecting its registry, which is loaded under under
HKU\<SID> while the service is running.
I begin to suspect that GPOs are not applied to service logons by design, but I cannot confirm or deny that. Is this true, and if not, how can I diagnose why the GPO is not applied to the service identity user?