How to renew computer serfificates in AD gp based system before term ends?

Question

Hello.

We have internal CA server and AD based distibution of certificates to computers by group policy.
I'ts all good and fine, but now we had to edit computer certificate template
for certificate based autentication to network with radius. (yes we use computer certificates not user sertificates)

This works also fine when i manually update computer certificate from client side by certificates mmc.

But how can I command all computers to update their sertificates mid term
so all of them get new sertificates with modified field?
(change of SUBJECT fied from empty to DNS name)

Matti T

Answer 1

If you use certificate autoenrollment, then go to affected certificate template (in certtmpl.msc), right-click on it, Reenroll all certificate holders menu item. When autoenrollment triggers next time (within 1 day), it will detect that existing certificate must be renewed out of standard AE renewal schedule and will reenroll the certificate from updated template.