How to Configure Certificate Auto-Enrollment with Group Policy
Applies to: Windows Server 2019, 2022 and 2025.
Auto-enrollment issues and renews certificates for managed computers or users based on template permissions and GPO scope.
PKI changes affect trust across the organization. Use an approved certificate policy, offline backups and separation of duties. Visit networkmanager.info.
Prerequisites
- Publish an auto-enrollment template.
- Grant Read, Enroll and Autoenroll.
- Use a test OU.
- Confirm CA chain and CRL reachability.
Procedure
Step 1: Create GPO
Use descriptive name.
New-GPO -Name 'PKI - Computer Autoenrollment'Step 2: Link to test OU
Target managed computers.
New-GPLink -Name 'PKI - Computer Autoenrollment' -Target 'OU=Test Servers,DC=corp,DC=example'Step 3: Enable policy
Configure Certificate Services Client - Auto-Enrollment under Computer Public Key Policies.
Step 4: Choose renewal options
Enable renewal, pending request and template update handling.
Step 5: Apply
Refresh and pulse enrollment.
gpupdate /force
certutil -pulseStep 6: Inspect store
Confirm expected certificate and key.
Verification
Review machine certificates and lifecycle events.
Get-ChildItem Cert:\LocalMachine\My | Select Subject,Issuer,NotAfter,HasPrivateKey
Get-WinEvent -LogName 'Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational' -MaxEvents 50Rollback and recovery
Disable or unlink the GPO and remove Autoenroll permission. Revoke certificates only when policy requires.
Security notes
Effective scope is the intersection of GPO application and template permissions.
Official references
Explore Netcloud24 Canada.
