Group Policy for Computer Certificates

[Andrew Mitchell]

Hi,
I'm attempting to get auto distribution of computer certificates working in a
lab environment.
I have a Win2003 (standard) DC with the enterprise root CA installed, which
appears to be working OK. It has managed to assign the domain controller
certificate to itself. This is the only server in the lab. There are no
intermediate CA's.

Where I'm having a problem is in using group policy to distribute computer
certificates to client PC's. When creating the group policy and running the
Automatic Certificate Request Setup Wizard I select Computer certificate, but
then on the next screen there are no CA's to choose from.

Is this indicative of the CA not being published in AD and, if so, does
anyone know a way to get it to publish? The only other thing I can think of
is that the CA is not setup as an 'issuing' CA, but I can't find any way to
specify this.

Any assistance would be appreciated.

TIA
Andy.

 

[David Cross [MS]]

I thought that in windows server 2003 and XP GPO, you no longer have to
specify a CA in the ACRS settings. Have you made sure thr "computer"
template is available on the enterprise root CA?