User certificate autoenrollment fail when UAC is active (Windows 10)

Question

Hi everyone,
I have an issue with user certificate autoenrollment. After a long analysis I found that when UAC is enabled, the autoenrollment process fails logging event ID 47 Source CertificateServicesClient-Certenroll: Certificate enrollment for domain\username could not enrol for a UserCertificateName certificate. A valid certification authority cannot be found to issue this template.

With UAC turned off everything works fine and the user got the certificate immediately at logon.

If user tries to request a certificate manually using the mmc snap in everything works fine even with UAC turned ON

I noticed also that certutil -templateCAs <template name> fails if launched form a NON elevated prompt

Environment specs:
DC: Windows server 2016
CA: Windows server 2016
Client: Windows 10 20H2

Any help would be appreciated
Thanks
Luca

Answer 1

Hello,

For a start you should check the information below in your environment:

Check whether this machine has configured certificate auto enrollment GPO.
Check whether the certificate template is issued on CA server.
Check whether the machine has read, enroll and autoenroll permissions for this certificate template.
Check whether all machines or only one machine has such issue.

If it does not work above, because certificate templates are stored on DCs not CA server, please check AD replication is working fine by running repadmin /showrepl and repadmin /replsum.

For various reasons, the GPO you have created may not actually be applying to the workstation. To verify this, you can use the Registry Editor.

Press the Windows+R keys in combination on your keyboard to bring up the Run prompt. Type regedit and press OK.
In the tree-view on the left, navigate to HKLM\Software\Policies\Microsoft\Cryptography\AutoEnrollment and verify the value of AEPolicy is set to 0x00000007.
In the tree-view on the left, navigate to HKCU\Software\Policies\Microsoft\Cryptography\AutoEnrollment and verify the value of AEPolicy is set to 0x00000007.
If either of these values are incorrect, the GPO you created is not applying correctly. You will want to use standard GPO troubleshooting tools such as gpupdate /force and gpresult /h to troubleshoot this further.

Note: for more information about these registry values, you can read a Microsoft blog post about them here.

Certificate Template Permissions
If the user, or a group the user is a member of, does not have the correct permissions on the certificate template the prompt will not appear. On the certificate template, verify that the permissions for your user (or group) on the security tab of the template properties are as below.

Read: Allow
Enroll: Allow
Autoenroll: Allow
User Already Has a Certificate in the Certificate Store
If the user already has a certificate in the Personal certificate store, it will assume auto-enrollment has already taken place and will not prompt. To verify this, you can use the certificates MMC.

Press the Windows+R keys in combination on your keyboard to bring up the Run prompt. Type mmc and press OK.
Note: If prompted by UAC to run MMC as administrator, select Yes.
Click File > Add/Remove Snap-in...
Select Certificates from the Available Snap-ins, press Add >.
Ensure My user account is selected and press Finish.
Press OK.
In the tree view on the left hand, navigate to Certificates - Current User\Personal\Certificates.
In the main view, check to see if there are any certificates issued to your user. If so, delete them and then next time you log in, the auto-enrollment prompt should appear.
Additional Steps
If the auto-enrollment prompt/tray icon still do not appear, consider the following additional steps.

Use certutil -pulse to pulse auto-enrollment events.
Force a Group Policy update by running gpupdate /force.
Have the user reboot and log back in.
Wait up to 8 hours to make sure smart card-related configuration has propagated within the domain.
The command certreq -enroll <TEMPLATENAME>, where <TEMPLATENAME> is the name of your certificate template can be used instead of the tray icon to kick off the Certificate Enrollment wizard.

---

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

Hello,
Thank you for your reply. As I said before, I've already performed a quite deep analysis, checking everything you mentioned and I can confirm that GPOs, Registry Keys, permissions, replications, network access are all as expected.
After turning on the logging, I had this event log entry.

event ID 47 Source CertificateServicesClient-Certenroll: Certificate enrollment for domain\username could not enrol for a UserCertificateName certificate. A valid certification authority cannot be found to issue this template.

I tried certutil -pulse command
the command fails with this error code
0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

I noticed also that certutil -templateCAs <template name> fails if launched form a NON elevated prompt

As I said everything works fine with UAC turned off.

Answer 3

I found the solution finally!

The "Certificate Service DCOM Access" group was empty. No idea why.

I added "Authenticated Users", "Domain Computers", "Domain Users" and "Domain Controllers" to that group and everything started running normally.

]2