I have a group policy and certificate template in place which automatically enrolls user accounts within a certain group with a certificate from the Enterprise CA (Windows 2012 AD).
Credential roaming is enabled, and the certificate is published in AD, so that each account gets one cert which is installed, with private key, automatically when the account logs on. This is all working fine for interactive logon on any machine in the domain.
Certificate auto-enrollment and installation does not occur, however, when an account is configured for a local service on the machine. The service starts correctly (after being given 'log on as a service' right, of course) - but I can see no certificate being issued for it by the CA; and no event log entries are generated on the CA machine from the certification authority.
I suspect the issue is something to do with the logon not being interactive.
Either way, I really need to find a way to be able to trigger the auto-enrollment process when the service starts for the first time on the target machine, and my google-fu is not yielding much in the way of help!