Windows 11 Client Not Auto-Enrolling Certificates

Question

Hello Everyone

I'm having a strange issue after upgrading one of my client computers to Windows 11 using SCCM Task Sequence (TS).

Windows 11 has been installed, but since the very beginning I noticed the SMS service is set to disabled.

I later on realized that's because the client certificate has been deleted and is not present on the client device:

I tried GP update, but the client was not pulling certificate from the CA server.

I even tried to set the GPO manually on the client machine to enable the auto enrollment both for user and the computer:

But I still didn't receive any PKI certificate from the CA server.

I tried to change the compatibility of the template from the CA server, which did not help :

I appreciate any help on this matter since I'm kinda out of option at the moment

Cheers

Answer 1

Hi,

If the SCCM clients are configured to use HTTPS, we want to check the Certificate Manager for the local machine (Run > certlm.msc).

SMS service is set to disabled.

The ccmexec.log file on the client computer records the activities of the SMS Agent Host service. This log is located in C:\Windows\CCM\Logs.

Look for any errors or warnings that might indicate why the service was disabled.

Answer 2

Hi,

It sounds like you've been through quite a bit of troubleshooting already! Here are a few additional steps you can try to resolve the certificate auto-enrollment issue on your Windows 11 client:

1. Refresh Group Policy:
   • Run gpupdate /force on the client machine to ensure that the latest Group Policy settings are applied. Additionally, you can use certutil -pulse to trigger certificate auto-enrollment manually.
2. Review Event Logs:
   • Check the Event Viewer on the client machine for any errors or warnings related to certificate enrollment.
   • GPresult /H Gpeport.html
   • Is your Group Policy Object (GPO) linked to the specific Organizational Unit (OU) or the domain?

https://learn.microsoft.com/en-us/windows-server/networking/core-network-guide/cncg/server-certs/configure-server-certificate-autoenrollment

If these steps don't resolve the issue, it might be helpful to provide more details about any specific error messages or logs you are seeing. This can help narrow down the potential causes and solutions.

Let me know if you need further assistance!