I have a certificate template published on my domain-joined Server 2016 Enterprise CA - I'm trying to set up certificate autoenrollment for our internal webservers.

When the template has read/enroll/autoenroll permissions granted directly to a Computer Account, the computer in question can autoenroll.

When read/enroll/autoenroll permissions are assigned to the built-in group "Domain Computers", (any) domain joined computers can also autoenroll.

When security permissions are assigned to a global security group containing computer accounts as members, these computers cannot autoenroll. When using the "request new certificate" from the computer's certificate manager - I can select the template in question, but it fails with the error "The permissions on the certificate template do not allow the current user to enroll for this type of certificate". I can see failures on the CA when doing a GPUpdate on a computer which should have permission to enrol.

I suspect I'm missing something stupid - any suggestions on things to check?

  • 1
    Did you reboot the servers after adding them to this Security group? If not, you'll need to.
    – joeqwerty
    Oct 17 '17 at 11:18
  • Herp, that was it. My suspicions were correct. Thanks :)
    – JMP
    Oct 17 '17 at 23:59
  • Glad to help...
    – joeqwerty
    Oct 18 '17 at 0:36

You need to reboot the servers after changing their Security group membership.

  • As an addendum: a reboot is not strictly necessary, it's possible without a reboot if you purge the kerberos ticket cache for the system account on the computer: serverfault.com/questions/159231/…
    – JMP
    Oct 18 '17 at 1:00
  • True, but a reboot is usually the quickest, most efficient way. I wanted to keep my answer as simple and as straightforward as possible. Thanks for the assist nonetheless.
    – joeqwerty
    Oct 18 '17 at 1:04
  • it's definitely easier, yes :)
    – JMP
    Oct 18 '17 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.