Share via


Controlling enrollment access to certificate templates

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2

Controlling enrollment access to certificate templates

Certificate templates are published on a server. Each contains an access control list (ACL) which defines what specific operations a subject can do with the certificate.

Setting Description

Full Control

The selected group or user can perform any action on this template.

Read

The selected group or user can read this template.

Write

The selected group or user can modify this template.

Enroll

The selected group or user can submit a certificate issuance or renewal request based on this template.

Autoenroll

The selected group or user can submit a certificate request based on this template by way of autoenrollment. This option will not work unless the Enroll option is also selected.

The most common use of certificates is for subject enrollment with autoenrollment permitted. In this case, the subject must be granted Read, Enroll and Autoenroll permissions. If autoenrollment is not wanted but manual or Web-based enrollment is, granting the Read and Enroll permissions is appropriate. When subjects already hold a certificate, they only need Read and Enroll permissions to renew that certificate, whether they use autoenrollment or not.

Write and Full Control permissions should be restricted to CA managers to ensure the templates are not improperly configured.