Issues with Automatic Certificate Renewal for Domain Computers
Asked by
TechieExplorer42
I'm attempting to set up a certificate template, based on a working one, that will enable Domain Computers to renew their issued certificates automatically before they expire. Despite my efforts, it hasn't been functioning as expected during testing, and I'm unsure what's going wrong.
I've enabled the setting in Group Policy at `ComputerPoliciesWindows SettingsSecurity SettingsPublic Key PoliciesCertificate Services Client - Auto-enrollment`, ensuring both the renew and update certificates options are checked, with expiration logging set to start at 10%.
However, when using `gpupdate /target:computer /force` or `certutil -pulse`, I come across an Event ID 1003 in the Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational log, but it fails to renew the certificates. What could I be overlooking, or where else might I check to figure out why the certificates aren't renewing?
Answers
Also, double-check if your template is configured correctly for auto-enrollment. Sometimes, the template settings can have specific constraints that might need to be adjusted.
Reply to this answer
Have you granted the domain computers the necessary permissions on the template? They need to have Read, Enroll, and Autoenroll permissions to successfully renew the certificates.
Reply to this answer
Make sure that your Group Policy settings are applying correctly. You can check the results with `gpresult /h report.html` to confirm that the settings are being enforced on the target machines.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions