Automatic certificate enrollment for local system failed

We have 2 Win2003 Domain Controlers with SP1 installed - dc01 and dc02.
On dc01, I have installed the certificate service and configured Certificate
autoenrollment through Group Policy.

Every thing has been working fine for almost one year.
However, recently, the dc02 gets an error in the event viewer for every 8
hours:

Event Type: Error
Event Source: AutoEnrollment
Event Category: None
Event ID: 13
Description:
Automatic certificate enrollment for local system failed to enroll for one
Domain Controller certificate (0x80070005). Access is denied.
Access is denied.

Any idea would be appreciated

check here
Description of the changes to DCOM security settings after you install
Windows Server 2003 Service Pack 1
http://support.microsoft.com/kb/903220/en-us

Yes, if you did not do it for SP1, then the same issue will exist in SP2

[jmattern]

Does this info works if you have SP2 instead of SP1? I'm getting that same error too, but with SP2 on it.

I have this same error, am missing the CERTSVC_DCOM_ACCESS group and have a similar configuration but with one difference:

I have three DCs running Win2003 SP2
I do not have Certicate Services installed on any DC or any member server.

Naturally, if I try to add the CERTSVC_DCOM_ACCESS group using the method suggested in the Microsoft KB article (http://support.microsoft.com/kb/903220/en-us):

certutil –setreg SetupStatus –SETUP_DCOM_SECURITY_UPDATED_FLAG
net stop certsvc
net start certsvc

I get the following error on each DC because I have no certificate services on those or on any other member server:

C:\>certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG
CertUtil: -setreg command FAILED: 0x80070002 (WIN32: 2)
CertUtil: The system cannot find the file specified.

Every post I have read so far seems to assume that those with this problem *have* certificate services installed somewhere and that isn't necessarily true. When Win2003 SP1 is installed, is it supposed to automatically add the CERTSVC_DCOM_ACCESS groupto DCs regardless of whether there are any Cert Servers, or is it a pre-requisite of the service pack that I first have installed a Cert Server?

If my solution to adding the CERTSVC_DCOM_ACCESS group is to first install a Cert Server and then re-apply SP1 or SP2, I'll do so but I don't necessarily want to install a Cert Server in my domain if I don't otherwise have to.

[schlesin]

I am receiving a similar error, and also have not installed Certificate Services... is this required.. I would guess if i do not have it (CA) installed I would just communicate with my DC (between DC), non-encrypted.