Windows 11 Client Not Auto-Enrolling Certificates

Anthony Vand 136

Hello Everyone

I'm having a strange issue after upgrading one of my client computers to Windows 11 using SCCM Task Sequence (TS).

Windows 11 has been installed, but since the very beginning I noticed the SMS service is set to disabled.

I later on realized that's because the client certificate has been deleted and is not present on the client device:

{6ABD2DCD-98E2-47F2-B385-193E9C0A332F}

I tried GP update, but the client was not pulling certificate from the CA server.

I even tried to set the GPO manually on the client machine to enable the auto enrollment both for user and the computer:
{3BEEB678-0647-4228-928D-37A9A83A61B7}

But I still didn't receive any PKI certificate from the CA server.

I tried to change the compatibility of the template from the CA server, which did not help :

{CF6BE4AC-1FA0-4CAB-982C-38DD86AFABF4}

I appreciate any help on this matter since I'm kinda out of option at the moment

Cheers

Tobi S 20 Reputation points

2024-11-21T14:27:53.7966667+00:00

Hello Anthony,

I have the same problem as you and I'm happy to find someone else with this behavior ;-)

Did you install Windows 11 24H2??

We started to test Windows 11 24H2 (November Patch) and realized that our VPN Software, which is using the user certificate, is not working anymore.

I did the same troubleshooting as you, so GPO and PKI templates are fine, but the auto-enroll of the user cert is not working anymore. Also the manual step with the command "certutil -pulse" will not add the certificate from the AD user object.

By the way, the auto-enroll of the computer certificate is still working and also a new user cert could be requested with the same template.

For me it looks like an bug of Win11 24H2. With some older Win11 releases and also with Win10 the auto-enrollment of the user certificates are fine.

I createda Microsoft ticket and hope that they will find anything. Strange, that nobody else have this kind of problems.

Please let me know, if you have some further information, I'll keep yp up-to-date too.

Have a good day

Accepted answer

XinGuo-MSFT 21,276 Reputation points

2024-10-29T07:12:27.6433333+00:00

Hi,

If the SCCM clients are configured to use HTTPS, we want to check the Certificate Manager for the local machine (Run > certlm.msc).

SMS service is set to disabled.

The ccmexec.log file on the client computer records the activities of the SMS Agent Host service. This log is located in C:\Windows\CCM\Logs.

Look for any errors or warnings that might indicate why the service was disabled.
Please sign in to rate this answer.
Anthony Vand 136 Reputation points

2024-10-29T13:39:50.75+00:00

Ok here's what I did to resolve the problem (At least for now):

Removed the client from the domain

Add it back to the domain

Remove all the personal certs in certml.msc

Run GPupdate

Reboot

Pushed the client installation from SCCM server, making sure all below are marked:

Stop the setup after a few minutes (Since its failing)

Uninstall SCCM by going to the C:\Windows\ccmsetup folder using an admin CMD and running the command : ccmsetup.exe /uninstall

Reboot

Delete the remainder of CCM and CCMsetup folder from Windows folder

THEN

Pushed the client installation from SCCM server, making sure all below are marked:

Then I noticed the SCCM is installed and running as usual

I still don't see the DP certificate in certmgr.msc

XinGuo-MSFT 21,276 Reputation points

2024-10-30T01:29:56.91+00:00

That's wonderful to hear! Thank you for your feedback. Please click 'Accept Answer' to close this thread.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

XinGuo-MSFT 21,276 Reputation points

2024-10-29T02:06:54.2566667+00:00
Hi,

It sounds like you've been through quite a bit of troubleshooting already! Here are a few additional steps you can try to resolve the certificate auto-enrollment issue on your Windows 11 client:

Refresh Group Policy:

Run gpupdate /force on the client machine to ensure that the latest Group Policy settings are applied. Additionally, you can use certutil -pulse to trigger certificate auto-enrollment manually.

Review Event Logs:

Check the Event Viewer on the client machine for any errors or warnings related to certificate enrollment.

GPresult /H Gpeport.html

Is your Group Policy Object (GPO) linked to the specific Organizational Unit (OU) or the domain?

https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-server-certificate-autoenrollment

If these steps don't resolve the issue, it might be helpful to provide more details about any specific error messages or logs you are seeing. This can help narrow down the potential causes and solutions.

Let me know if you need further assistance!
Please sign in to rate this answer.
Anthony Vand 136 Reputation points

2024-10-29T05:17:33.2366667+00:00

Thank you for you reply

Everything started happening after I upgraded the client to Windows 11 today, before that on Windows 10, everything was working fine, and still is, for other clients. So that rules out anything related to GPO or server-sided IMHO.

I tried GPupdate /force, and it completed successfully and not error was in the event viewer.

Please also find the result for GPresult /H:

In fact, I can see the auto-enrollment policy being applied on the computer, but the certificate is not generated

The GPO is linked to an OU which remained unchanged before and after the update.

Thanks

Tobi S 20 Reputation points

2024-11-26T07:51:30.05+00:00

Hi Anthony,

did you upgrade to the latest Windows 11 release 24H2. We have the same situation like you on new 24H2 installations and inplace upgrades, so no certificates will be auto-enrolled from the AD. New certificates could be requested and also the auto-enroll for the computer certificates is working, but no user certs. GPO and PKI templates are fine, so everything is working on older releases, WIndows 10 included. I opened a Microsoft ticket and waiting for reply. Would be good to know, if you have futher information. Strange, that no others reports this problem, looks like an Windows 11 24H2 bug for me.

Thanks

Anthony Vand 136 Reputation points

2024-11-26T23:08:35.9666667+00:00

Hello Schwalbach Tobias

I used 23H2 and not 24H2. For some reason the setup would fail with 24H2 media so I used 23H2.

Yes, you are correct, I noticed that too at the time, which there are no more user certs under certmgr.msc, only the computer cert in certlm.msc.

However that did not cause me any problems, the client still continued to receive PKI certificates after following the steps I provided above from the SCCM server.

If you see that the issue does not happen in older version of Win 11 like 23H2 , then I recommend use that version for now.

I also agree that it could be a bug, as mentioned, I wasn't even able to push that version via SCCM.

But keep me posted, Ill be happy to help if anything

alex 0 Reputation points

2024-11-29T00:24:44.0833333+00:00

Hi everyone,

I got the same issues with Windows 23H2.

Anthony Vand 136 Reputation points

2024-11-29T08:29:55.9466667+00:00

For SCCM?

Tobi S 20 Reputation points

2024-11-29T12:07:31.1733333+00:00

Thanks for your reply Anthony.

Just to clarify, I have to problem with SCCM, just with the general auto-enrollment of user certificates on Windows 11 24H2.

So, sorry for crashing your question a little bit, it was the only article I found with a similar problem.

I'm not sure, if Alex has the problem on SCCM or like me a general problem with the cert auto-enroll.

Have a good weekend

Anthony Vand 136 Reputation points

2024-11-30T04:04:37.6066667+00:00

Schwalbach Tobias

No worries, all good

Yes, I understand. As you stated, it seems like a bug. Otherwise, why should users be able to auto-enroll on Win 10 and not Win 11, while Win 11 is based on Wind 10 for the most part ?

Hopefully someone from MS gets back to you.

Please share your response if you hear back from them

alex 0 Reputation points

2024-12-01T21:34:10.2166667+00:00

Hi all,

I would like to clarify. I I updated Windows 10 to Windows 11 23H2 using SCCM Feature Update. It looks like this is a general problem with certificate auto enrolment for me.

Anthony Vand 136 Reputation points

2024-12-02T17:27:35.6166667+00:00

My SCCM clients are working fine w/o the client certificates, only using machine certificate, after following the provided steps to reinstall SCCM

alex 0 Reputation points

2024-12-04T21:45:41.5833333+00:00

Hi all,

My issue was related to CA thumbprints in Wi-Fi profile.

In Windows 10, EAP-TLS authentications could successfully validate the server based solely on the presence of the trusted root certificate in the Windows trusted root store.

In Windows 11, the trusted root certificate thumbprint must be added to the wireless profile.

In my case Wi-Fi profile contained outdated trusted root certificate thumbprint. For Windows 10 it was okay, but not for Windows 11.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
ComputerHabit 1,011 Reputation points

2025-02-20T20:05:47.6133333+00:00

Still an issue. :(

I just setup a lab to try and figure out what's up. Brand new lab with brand new ca and win11 24h2 does not autoenroll certs
Please sign in to rate this answer.
Tobi S 20 Reputation points

2025-02-21T07:25:59.7733333+00:00

Hi,

we found out, that without the checkbox "Do not automatically reenroll if a duplicate..." in the certificate template the autoenroll of the user certs is working again in Windows 11 24H2.

The only negative aspect is, we would have a lot of more certificates for users which are working on different machines.

For me it looks like the Credential Roaming GPO is not working in 24H2 and therefore just the first device will get the user cert.

ComputerHabit 1,011 Reputation points

2025-02-21T13:40:25.74+00:00

Hello Tobi,

I am not having the same results.

In the new lab I copied the "user" template.

The default is to not auto reenroll for duplicates.
Domain users have autoenroll.

I even tried to add read access to see if it helped.

I also updated the template compatibility.

I can see the templates when using certmgr.msc but autoenroll does not show them.

But using the autoenrollment the certs do not show.

Status shows as unavailable if I show all templates.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.