Trouble with Auto Certificate Deployment in Active Directory

You might want to verify that the Domain Controller Authentication template is actually issued on your Certificate Authority (CA). Sometimes it can appear in the console but isn't actually listed under "Certificate Templates to Issue.” Also, check whether the template's security settings allow the Domain Controllers to both enroll and auto-enroll. Run `certutil -template` on one of the DCs to see if the template appears there. If it's missing, the CA may not be offering it. Don’t forget to check the AutoEnrollment event logs for more details too.

It sounds like you need to ensure that the Kerberos Authentication template is enabled for your Domain Controllers. Also, double-check if the auto-enrollment is set properly in your certificate client group policies. It's crucial to configure this correctly because misconfigurations can lead to significant privilege escalation issues.

It’s possible you missed installing the trusted root certificate in your Group Policy. For an internal CA, which is usually self-signed, you need to ensure this root certificate is deployed to the Trusted Root Certification Authorities of each domain system. If not, even if you ask the machines to retrieve new certificates, they won’t be able to use them. It's best to publish the root CA in the directory store so all domain members can access it automatically.