I am having difficulty setting up autoenrollment for computer
certificates with Windows 2003 SP1 Enterprise Edition CA server. I
have the GPO setup to perform autoenrollemtn and Automatic Certificate
Request to request a computer certificate as specified in a number of
documents. The end workstation or server upon boot or gpupdate
responds with a Event ID 7:
Automatic certificate enrollment for local system could not enroll for
Computer certificate template due to one of the following:
Enrollment access is not allowed to this template.
Template subject name, signature, or hardware requirements cannot be
met.
No valid certificate authority can be found to issue this template.
So it obviously seeing the autoenrollment policy. I checked the
computer template under Certificate Templates on the CA, and Computer
was indeed set to no for autoenrollment with no option to change that.
I selected to enable a new template (Workstation), which was yes to
autoenrollment, but it does not appear in the Automatic Certificate
Request Wizard as a template to request.
Any help would be appreciated.