CEP Certificate Template Permissions

Question

Hi Folks,

I have managed to get CEP and CES installed, it is running on a separate host to my Enterprise CA and I have delegation setup and this appears to be working fine, my Windows 11 client can see the default certificate templates.

The issue I have, is that any additional templates I add at the CA never appear for this user, I have seen that there is a known issue with versions of templates and windows in this article:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/cannot-select-windows-server-2016-ca-compatible-certificate-templates

But even if I set 2003 compatibility the templates never appear for the end user, has anyone else seen this??

If I attempt enrolment via WCCE the user can see and enrol for all of the new templates I have created

Answer 1

Sorry, I misread your question, I thought it is about CEPEncryption and NDES.

Speaking about your problem it is by design. CEP template list is cached and agent re-fetch it every 8 hours by default. This means that template changes detection on agent can take up to 8hrs. You can try to delete enrollment policy cache on client by deleting the following folders depending on a context:

• user templates

%userprofile%\AppData\Local\Microsoft\Windows\X509Enrollment

• machine templates

%programdata%\Microsoft\Windows\X509Enrollment

then retry enrollment.

Update: you cannot change cache lifetime interval using GPO, because it is CEP server setting. Do the following in order to change cache lifetime interval:

1. Log on to CEP server
2. 1. Launch IIS manager
3. Expand "Default Web Site" and select CEP application
4. 1. in middle pane, press Application Settings button. You will see several settings there.
5. Add (if doesn't exist yet) a new setting with name nextUpdateHours and specify your value in hours. Keep in mind that you cannot set it to less than 1 hour.

Answer 2

this is deleted