Renewed CA certificate and Auto-enrollment

[Steve Carr]

I seem to be having an issue with my Domain Controllers using
auto-enrollment to my CA since I renewed my certificate. I followed the
instructions from Q270048 about recreating the auto-enrollment policy within
group policy but still my DCs are getting "Access Denied" (Denied by Policy
Module). Any ideas out there on how to fix this? Thanks in advance.

The specs:
Win 2K with SP3 plus all present hotfixes

 

[Laudon Williams [MSFT]]

Have the DCs refreshed group policy? If not, gpupdate /force will cause them
to update and get the new policy.

 

[Steve Carr]

the group policy was forced to no avail. One other clue, the error includes
"configuration information cannot be retrieved from the DC". Any other
thoughts?

 

[Steve Carr]

nevermid, the last post made a lightbulb come on. The CA server no longer
had rights to read DC info. Problem solved. Thanks all

 

[Laudon Williams [MSFT]]

On what system is this error occuring? Is the CA running on a separate box
than the DC?