Computer's not auto-enrolling after first enrollment

mgordon-spi used Ask the Experts™
We currently have Active Directory Certificate Services (via Group Policy) serving out Machine/Computer Certificates to provide authentication for our Wireless Network. After the initial setup all the computers have had no issue receiving the certificate via Auto enrollment but it seems if we rebuild a client (ala Ghost/Reimage) they no longer get a machine certificate nor is it possible to enrol manually using Certificate Management in MMC (the option for machine/computer certificate does not appear in the list).

I have checked the settings in Group Policy and we have enabled the updating of existing templates & auto re-enrollment.

I have checked permissions with ADSIedit for the PKI infrastructure with no issues apparent.

Clients are a mostly Windows 7, Vista SP1 with a few still on XP SP2
Cert Server is 2008 R2 running ADCS (also running NPS for RADIUS auth for the Wireless Network) and have 1 2008 R2 DC, 1 2008 DC and 1 2003 PDC in a Windows 2003 Domain/Forest Functional level

Any ideas or diagnostics I should try?
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Firstly (assume you have already done so) just have a quick look in the event logs and see if anything stands out.

certutil is the client tool you want for diagnostics in this case, particularly the -adca and -policy options, but obviously a /? will point you in the right direction.
Use the Group Policy Management Console to configure computer autoenrollment policy settings, and use the Certificate Templates snap-in to configure autoenrollment settings on the certificate.
Just a update

I did some further research and noted that on the certificate template domain computers had the enroll permission but not the read permission (this was the default permissions granted when setuping up the ADCS server). I adjusted so they have both, reimaged a notebook and they recieved a brand new certificate.

Thanks for your assistance


While the comment made by matjm helped narrow down where the problem lie, it was utimately external research that led to the final answer

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial