How to Configure Certificate Autoenrollment with Group Policy Print

Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.

Certificate autoenrollment issues and renews approved user or computer certificates through Active Directory policy.

Prerequisites

• Administrative access to the affected servers.
• A verified backup and approved maintenance window.
• A pilot system for testing before production rollout.

Step-by-step procedure

1. Publish a controlled certificate template.
2. Grant Enroll and Autoenroll only to the target group.
3. Enable autoenrollment in a scoped GPO.
4. Refresh policy on one pilot computer.

Commands

gpupdate /force
certutil -pulse
Get-ChildItem Cert:\LocalMachine\My | Select Subject,NotAfter,Thumbprint
gpresult /h C:\Temp\autoenrollment.html

Verification

The pilot receives the expected certificate and autoenrollment events show a successful request.

Rollback

Disable the GPO setting and remove template permissions; revoke mistakenly issued certificates if required.

Security and operations

• Use least privilege and document all production changes.
• Replace example addresses and names with approved values.
• Review relevant Windows event logs after implementation.

Related resources

Canadian Windows VPS and RDS hosting is available from networkmanager.info. Also review the official Microsoft Windows Server documentation.