certmon.de DE

Autoenrollment not renewing certificates? A checklist

Autoenrollment makes computers request certificates from your enterprise CA themselves and renew them in time. When one link in the chain breaks, nobody notices – until the certificate expires. This checklist goes through the usual causes in order. Run all commands on the affected computer in an elevated PowerShell.

1. Trigger autoenrollment now and see the errors

Autoenrollment normally runs at startup, on every Group Policy refresh and roughly every eight hours. To trigger it immediately:

gpupdate /force
certutil -pulse

The result ends up in the Application log under the source CertificateServicesClient-AutoEnrollment (failures e.g. with ID 6 and an error code such as 0x800706ba = RPC server unavailable). More detail is in “Applications and Services Logs → Microsoft → Windows → CertificateServicesClient-Lifecycle-System → Operational”.

2. Is the Group Policy in effect?

Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → “Certificate Services Client – Auto-Enrollment”: configuration model Enabled, both boxes ticked (renew expired certificates … and update certificates that use certificate templates). To check whether it reached the computer:

Get-ItemProperty HKLM:\SOFTWARE\Policies\Microsoft\Cryptography\AutoEnrollment

AEPolicy should be 7. If the key is missing, the policy doesn't apply – gpresult /h report.html shows why (filtering, link, OU).

3. Is the computer allowed to use the template?

In certtmpl.msc → template → Security, the computer (or a group it's a member of) needs Read, Enroll and Autoenroll. Without “Autoenroll”, Windows won't renew anything on its own.

If the computer was only recently added to the group, its Kerberos ticket doesn't know about the new membership yet. Reboot, or:

klist -li 0x3e7 purge
certutil -pulse

4. Is the template published on the CA?

Nobody can request a template that isn't listed under the CA's “Certificate Templates to Issue”. To list the published templates, run this on the CA:

certutil -CATemplates

5. Is the CA reachable?

certutil -config "ca01.contoso.local\CONTOSO-CA" -ping

The config string is the CA server's DNS name plus the CA name; certutil -config - -ping opens a picker with all CAs instead. If the ping fails, check the “Active Directory Certificate Services” service on the CA, DNS and the firewall. Enrollment uses RPC/DCOM, so TCP 135 plus the dynamic port range 49152–65535 between client and CA.

6. Request manually – with an immediate error message

A manual request for the same template gives you the error straight away instead of in the event log. Use the template name, not the display name:

certreq -enroll -machine -q TemplateName

# Renew an existing certificate (thumbprint from certlm.msc)
certreq -enroll -machine -q -cert THUMBPRINT renew

Typical answers: “Access denied” (step 3), “RPC server unavailable” (step 5), “The request is pending” – in that case the template requires CA certificate manager approval (template → Issuance Requirements).

7. When does renewal actually happen?

Autoenrollment only renews within the template's renewal period (General tab, six weeks before expiry by default) – so a certificate that expires in three months is left alone for now. If you replaced a template with a new one, the new one must list the old one under “Superseded Templates”; otherwise Windows requests an additional certificate instead of replacing the old one.

And then?

A renewed certificate isn't automatically in use everywhere: IIS, NPS, SQL Server and other services often need to be rebound. Which services that affects is covered in Find expiring certificates on Windows servers. RDP and LDAPS have their own guides: RDP certificates, LDAPS certificates.

More guides