Windows Server · high · Exchange, WSUS, PKI & RDS

Certificate enrolment fails — template permissions and CA errors

The requester cannot see the template, cannot enrol against it, or the CA is refusing the request.

What you see

Auto-enrolment does not issue anything, or a manual request fails naming a template. The client event log carries the detail.

What is actually wrong

Template permissions missing Enroll or Autoenroll, the template not published on the CA, or the CA service unable to reach the directory.

Codes and articles

Event 13Event 220x80094012The permissions on the certificate template do not allowDenied by Policy Module0x800706ba certsrv

Fixes (2)

Publish the template and confirm the CA is reachable

Elevated PowerShell on the CA30 minutesmedium riskreversible

The template does not appear to the requester.

List which templates the CA is issuing. A template that exists in the directory but is not published here cannot be requested.
PowerShell
```
certutil -CATemplatesGet-CATemplate | Format-Table Name,OID
```

Publish it.

PowerShell

Add-CATemplate -Name 'WorkstationAuthV2' -Forcecertutil -CATemplates

Check the CA service is healthy and the client can reach it.

PowerShell

certutil -pingGet-Service CertSvc | Format-List Status,StartTypecertutil -config "CA01\Example Issuing CA" -ping

Confirm the client's autoenrolment policy is enabled — the template being published means nothing if the client is not told to enrol.
PowerShell
```
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\AutoEnrollment' -ErrorAction SilentlyContinue | Format-List AEPolicy
```
Auto-enrolment has to be enabled by Group Policy for computers and users separately. Publishing the template and setting the permissions is only two thirds of the job.

Trigger enrolment on a client and read the result.

PowerShell

certutil -pulseGet-WinEvent -LogName Application -MaxEvents 30 | Where-Object ProviderName -like '*CertificateServicesClient*' | Format-List TimeCreated,Id,Message

Confirm it workedThe certificate is issued and appears in the client's store.

PowerShell

Get-ChildItem Cert:\LocalMachine\My | Format-Table Subject,NotAfter,Template

If you need to undo itRemove-CATemplate unpublishes it again.

Set the template permissions correctly

Certificate Templates console30 minutesmedium riskreversible

The request is denied.

Read the denial on the client — it names what was missing.

PowerShell

Get-WinEvent -LogName Application -MaxEvents 40 | Where-Object { $_.Id -in 13,22 } | Format-List TimeCreated,Id,Message

Open the Certificate Templates console, find the template, and check the Security tab. The requester needs Read and Enroll, and Autoenroll as well if it is to enrol automatically.
PowerShell
```
certtmpl.msc
```
Read and Enroll without Autoenroll produces a template that works when requested by hand and never issues automatically — which is exactly the confusing half-working state most of these reports describe.
Never grant Enroll to Domain Users on a template that allows the subject name to be supplied in the request. That combination lets any user request a certificate in anybody's name.
This is the ESC1 misconfiguration and it is a full domain-compromise path, not a theoretical concern. It is worth checking every template for it while you are here.

Audit the templates for that combination.

PowerShell

Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,$((Get-ADRootDSE).configurationNamingContext)" -Filter * -Properties msPKI-Certificate-Name-Flag,msPKI-Enrollment-Flag,displayName | Where-Object { $_.'msPKI-Certificate-Name-Flag' -band 1 } | Format-Table displayName

Check the CA's own permissions allow the requester to request certificates at all.
PowerShell
```
certutil -getreg CA\Security
```

Confirm it workedThe certificate is issued to the intended requester and to nobody who should not have it.

PowerShell

certutil -view -restrict "Disposition=20" -out "RequestID,CommonName,CertificateTemplate,NotAfter" | Select-Object -Last 20

If you need to undo itPermission changes are reversible in the same console.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.