Computer Certificate autoenrollment Failed Requests

Question

Issue:

New Template used auto-entroll for Computer group thats getting a 'Failed Request' Event.

Event:

The permissions on the certificate template do not allow the current user to enroll for this type of certificate.

-Request Disposition Message: Denied by Policy Module

Checks I've done prior:

-Both Computer and User Auto-enroll settings fine in GPO's that are applied to computer machines

-Using Computer Group to apply permission on template ; they have read , enroll and auto-enroll

-templates are updating fine to active directory

-I've rebooted CA

-These certificates appear to allow me to enroll them, however, auto-enroll should do this automatically.

-We have other, older certificates utilizing Auto-enroll correctly.

In my Env, we have an offline line root, an issuing CA and a web server utilized for CRL web hosting and web signing.

Answer 1

Thank you for the recommendation.

-This group actually was a Universal, not Global group; so i correct that.

I would like to view Events on the client machine but do not have " On a client machine, enable detailed logging: Open Event Viewer > Applications and Services Logs > Microsoft > Windows > CertificateServicesClient > AutoEnrollment Review logs for specific errors or permission denials "

--Instead I have ,attached picture.

Answer 2

Dear John,

You're encountering a "Failed Request" event when attempting auto-enrollment using a new certificate template for a computer group. The error message reads:

"The permissions on the certificate template do not allow the current user to enroll for this type of certificate." Request Disposition Message: Denied by Policy Module

Here Are Recommended Next Steps

1. Verify Security Group Scope Ensure the computer group used for template permissions is a domain local group or global group and that the computers are direct members. Nested group membership may not be evaluated correctly during auto-enrollment.
2. Confirm Template Publication On the issuing CA, open Certification Authority > Certificate Templates Ensure the new template is listed and published correctly
3. Check Certificate Template Version If you're using a Version 3 or 4 template, confirm that the target machines are running Windows versions that support it (Windows Vista/Server 2008 or later)
4. Review DCOM and RPC Permissions Auto-enrollment relies on DCOM and RPC communication. Ensure that firewall rules and permissions allow certificate services traffic between client and CA
5. Enable Auto-Enrollment Logging
   • On a client machine, enable detailed logging: Open Event Viewer > Applications and Services Logs > Microsoft > Windows > CertificateServicesClient > AutoEnrollment Review logs for specific errors or permission denials
6. Force Group Policy Update and Enrollment Run the following commands on a client machine: Mã gpupdate /force certutil -pulse

If this guidance proves helpful, feel free to click “Accept Answer” so we know we’re heading in the right direction 😊. And of course, I’m here if you need further clarification or support. T&B, Domic