Auto cert enrollment

Question

1. what is differet between auto-enrollment(template auto-enroll), automatic certificate request in GPO? their result almost the same
2. i am not familiar with GPO, i see that if computer auto enroll, i only add the computer object a memeber of security group (leave it in original computer group) is not work,

but move the object to OU will make it works, is it a must to make a computer object into OU? for making group policy works?
thank you

Answer 1

what is differet between auto-enrollment(template auto-enroll), automatic certificate request in GPO? their result almost the same

automatic certificate request (ACR) is a first implementation of autoenrollment which was added in Windows 2000. ACR limits to V1 certificate templates (which you cannot modify) and machine subject. You cannot use ACR to deploy user certificates, for example.

Autoenrollment is a 2nd generation of Microsoft automatic certificate enrollment engine (which is current) and supports newer certificate templates.

but move the object to OU will make it works, is it a must to make a computer object into OU? for making group policy works?

yes. GPOs apply to DS containers and end entity objects inside the container (OU), i.e. users and computers. GPO doesn't apply to groups inside container, because they are not entities. Thus, you need to carefully plan your DS structure and GPO management keeping in mind how GPO is applied.