Windows PKI Server Issuing Computer (Machine) Certificates

Question

Windows PKI Server Issuing Computer (Machine) Certificates

jpcapone 1,776

I have inherited a Windows PKI server and I am investigating how it is being used. A few of the certificates being issued are because of auto enrollment and or wireless security. I am finding a lot of the certificates are of the Computer (Machine) variety. The Computer certificate template itself is not configured for auto enrollment. I can see that the cert is requested by the machine name. I am going to investigate further by logging into the requesting machine but I was wondering if anyone would know why this is happening? TIA!!!

Mohamed Javeed Thettilayil 10 Reputation points

2024-01-26T23:24:11.39+00:00

The "enrol" permission on a template along with the GPO "Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client - Auto-Enrollment" will cause automated certificate enrolment. So you can check all the cert template with the permission "enrol" as well as all the GPO applied on the server with the "Certificate Services Client - Auto-Enrollment".
jpcapone 1,776 Reputation points

2024-01-27T02:38:23.85+00:00

Ya and thats what i have done. The Computer (Machine) Certificate I am referring to is not configured for auto enrollment so thats my question. Why would a machine request a Computer (Machine) certificate?