Remove custom Application Policy from CA

naashan 21 Reputation points

I was trying to create certificate template for Remote Destop Services, and failed on the step:
"Create new Application Policy in Extensions tab, restrict the use scope of the certificate to Remote Desktop Authentication only (enter the following object identifier —
where i didnt put mentioned OID. Now im stuck with this misconfigured policy, and id like to get rid of it since it prevents correct usage of RDS template.
i already tried to delete it using certutil with following result:

certutil -oid delete -- Remote Desktop Authentication
pwszName = Remote Desktop Authentication
dwValue = 0
CertUtil: -oid command FAILED: 0x80070002 (WIN32: 2 ERROR_FILE_NOT_FOUND)
CertUtil: The system cannot find the file specified.

Remote Desktop
Remote Desktop
A Microsoft app that connects remotely to computers and to virtual apps and desktops.
3,243 questions
No comments
{count} votes

Accepted answer
  1. Carl Fan 6,786 Reputation points Microsoft Vendor

    Please check the information below:
    Because an Application Policy can be re-used across multiple templates, they are stored in Active Directory. Once an Application Policy is created, it is added to the list to be later re-used but there is no delete option so once an OID is added, it’s there for good. Even after deleting the Application Policy from the template, it remained in the list to select. After a short amount of looking in Active Directory Sites and Services (you could just as equally use ADSI Edit), I found that under the Public Key Services node, there is a Container named OID and sure enough in this container, there is a sub-container for each Application Policy and OID that is created. I deleted the Application Policy and the OID from AD and restarted the CA service to allow it to refresh the data from Active Directory. For reference, here’s what AD Sites and Services looks like when you enable the Services view from the toolbar and navigate down to the OID container.
    Hope this helps and please help to accept as Answer if the response is useful.
    Best Regards,

1 additional answer

Sort by: Most helpful
  1. naashan 21 Reputation points


    thanks for the tip, i will just add that naming in mentioned OID container is not obvious. I had to open properties of the record and confirm it on the atribute editor tab. (msPKI-Cert-Template-OID value)