CEP Certificate Template Permissions

Question

CEP Certificate Template Permissions

Michael Hathaway 21

Hi Folks,

I have managed to get CEP and CES installed, it is running on a separate host to my Enterprise CA and I have delegation setup and this appears to be working fine, my Windows 11 client can see the default certificate templates.

MicrosoftTeams-image (7)

The issue I have, is that any additional templates I add at the CA never appear for this user, I have seen that there is a known issue with versions of templates and windows in this article:

https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/cannot-select-windows-server-2016-ca-compatible-certificate-templates

But even if I set 2003 compatibility the templates never appear for the end user, has anyone else seen this??

If I attempt enrolment via WCCE the user can see and enrol for all of the new templates I have created

Michael Hathaway 21 Reputation points

2023-03-10T10:43:13.9433333+00:00
Ok, so a little update, the issue appears to be related to the windows client caching the templates, here is the process I am following that woks every time for WCCE:

Create new template at the CA

Assign the template in the CA so that it can issue certificates

On the CEP\CES server run "iisreset" command at the command prompt

On the client computer clear the cache with "certutil -f -policyserver * -policycache delete"

The new template does not display on the end point, I have also tried logging off and back on again, the only way to get the new certificate template to appear on the end point is to remove the Enrolment Policy Server and re-add it, then the new template will appear.

Has anyone seen this or have ideas?

Accepted answer

1 additional answer

Your answer

Michael Hathaway 21 Reputation points

2023-03-10T10:43:13.9433333+00:00

Ok, so a little update, the issue appears to be related to the windows client caching the templates, here is the process I am following that woks every time for WCCE:

Create new template at the CA

Assign the template in the CA so that it can issue certificates

On the CEP\CES server run "iisreset" command at the command prompt

On the client computer clear the cache with "certutil -f -policyserver * -policycache delete"

The new template does not display on the end point, I have also tried logging off and back on again, the only way to get the new certificate template to appear on the end point is to remove the Enrolment Policy Server and re-add it, then the new template will appear.

Has anyone seen this or have ideas?

Answer 1

Vadims Podāns 9,141 MVP

Sorry, I misread your question, I thought it is about CEPEncryption and NDES.

Speaking about your problem it is by design. CEP template list is cached and agent re-fetch it every 8 hours by default. This means that template changes detection on agent can take up to 8hrs. You can try to delete enrollment policy cache on client by deleting the following folders depending on a context:

user templates

%userprofile%\AppData\Local\Microsoft\Windows\X509Enrollment

machine templates

%programdata%\Microsoft\Windows\X509Enrollment

then retry enrollment.

Update: you cannot change cache lifetime interval using GPO, because it is CEP server setting. Do the following in order to change cache lifetime interval:

Log on to CEP server
1. Launch IIS manager
Expand "Default Web Site" and select CEP application
1. in middle pane, press Application Settings button. You will see several settings there.
Add (if doesn't exist yet) a new setting with name nextUpdateHours and specify your value in hours. Keep in mind that you cannot set it to less than 1 hour.

Michael Hathaway 21 Reputation points

2023-03-10T11:47:23.7433333+00:00

Hi @Vadims Podāns Many Thanks, yes, if I delete this cache file then the new templates do appear, WCCE doesnt work the same way and templates are retrieved dynamically every time you attempts to request a new cert.

Do you happen to know if the 8 hours is configurable in a GPO??
Vadims Podāns 9,141 Reputation points MVP

2023-03-10T13:01:20.4633333+00:00

see updated response
Michael Hathaway 21 Reputation points

2023-03-10T16:17:39.97+00:00

@Vadims Podāns Appreciate the responses, very helpful. Thank you!

Answer 2

Vadims Podāns 9,141 MVP

this is deleted

Michael Hathaway 21 Reputation points

2023-03-10T10:56:49.5833333+00:00

Thanks but this is not the issue, the problem is that new user and or machine certificates templates do not display on the end point if you add them to the CA after the Policy Server is added, all of the cert permissions are correct because WCCE enrolment for users and computers work fine.

Share via

CEP Certificate Template Permissions

1 additional answer

Your answer