Certification Authority

[timB]

I am trying to set up CA in a lab enviroment to work with EFS. I am using a
Lab enviroment, which consists of:

A Windows 2003 DC, 2003 Excahnge server, a number of other test servers,
test computers and one Windows 2003 Member server. The member server is
running certificate service as Enterprise root CA.

However the client computers are not getting certificates from the CA (only
the self signed personal certificates) and I am getting the following error
message when I look on the event viewer within the CA server:

Certificate Services denied request 16 because The requested certificate
template is not supported by this CA. 0x80094800 (-2146875392). The request
was for Domain Name\Computer Name.

Additional information: Denied by Policy Module 0x80094800, The request was
for a certificate template that is not supported by the Certificate Services
policy:
DomainController.

Any help would be greatly appriciated.

[Miha Pihler [MVP]]

Hi Tim

Does this help?

A Certificate Request That Uses a New Template Is Unsuccessful
http://support.microsoft.com/default.aspx?id=281260

--
Mike
Microsoft MVP - Windows Security


"timB" <timB@discussions.microsoft.com> wrote in message
news:489E3989-B07C-4EE1-9DC1-A89654743F6D@microsoft.com...
>I am trying to set up CA in a lab enviroment to work with EFS. I am using
>a
> Lab enviroment, which consists of:
>
> A Windows 2003 DC, 2003 Excahnge server, a number of other test servers,
> test computers and one Windows 2003 Member server. The member server is
> running certificate service as Enterprise root CA.
>
> However the client computers are not getting certificates from the CA
> (only
> the self signed personal certificates) and I am getting the following
> error
> message when I look on the event viewer within the CA server:
>
> Certificate Services denied request 16 because The requested certificate
> template is not supported by this CA. 0x80094800 (-2146875392). The
> request
> was for Domain Name\Computer Name.
>
> Additional information: Denied by Policy Module 0x80094800, The request
> was
> for a certificate template that is not supported by the Certificate
> Services
> policy:
> DomainController.
>
> Any help would be greatly appriciated.

[Miha Pihler [MVP]]

Hi Tim

Does this help?

A Certificate Request That Uses a New Template Is Unsuccessful
http://support.microsoft.com/default.aspx?id=281260

--
Mike
Microsoft MVP - Windows Security


"timB" <timB@discussions.microsoft.com> wrote in message
news:489E3989-B07C-4EE1-9DC1-A89654743F6D@microsoft.com...
>I am trying to set up CA in a lab enviroment to work with EFS. I am using
>a
> Lab enviroment, which consists of:
>
> A Windows 2003 DC, 2003 Excahnge server, a number of other test servers,
> test computers and one Windows 2003 Member server. The member server is
> running certificate service as Enterprise root CA.
>
> However the client computers are not getting certificates from the CA
> (only
> the self signed personal certificates) and I am getting the following
> error
> message when I look on the event viewer within the CA server:
>
> Certificate Services denied request 16 because The requested certificate
> template is not supported by this CA. 0x80094800 (-2146875392). The
> request
> was for Domain Name\Computer Name.
>
> Additional information: Denied by Policy Module 0x80094800, The request
> was
> for a certificate template that is not supported by the Certificate
> Services
> policy:
> DomainController.
>
> Any help would be greatly appriciated.

[Miha Pihler [MVP]]

Hi Tim

Does this help?

A Certificate Request That Uses a New Template Is Unsuccessful
http://support.microsoft.com/default.aspx?id=281260

--
Mike
Microsoft MVP - Windows Security


"timB" <timB@discussions.microsoft.com> wrote in message
news:489E3989-B07C-4EE1-9DC1-A89654743F6D@microsoft.com...
>I am trying to set up CA in a lab enviroment to work with EFS. I am using
>a
> Lab enviroment, which consists of:
>
> A Windows 2003 DC, 2003 Excahnge server, a number of other test servers,
> test computers and one Windows 2003 Member server. The member server is
> running certificate service as Enterprise root CA.
>
> However the client computers are not getting certificates from the CA
> (only
> the self signed personal certificates) and I am getting the following
> error
> message when I look on the event viewer within the CA server:
>
> Certificate Services denied request 16 because The requested certificate
> template is not supported by this CA. 0x80094800 (-2146875392). The
> request
> was for Domain Name\Computer Name.
>
> Additional information: Denied by Policy Module 0x80094800, The request
> was
> for a certificate template that is not supported by the Certificate
> Services
> policy:
> DomainController.
>
> Any help would be greatly appriciated.

[timB]

Thanks for your help, but that did not fix this issue. Some further
information:

When I try to request a new certificate through IE and I go to 'Request
Certificate' I receive the following error message on the page:

"No certificate template could be found. You do not have permission to
request a certificate from this CA, or an error occured while accessing
Active Directory"


"Miha Pihler [MVP]" wrote:

> Hi Tim
>
> Does this help?
>
> A Certificate Request That Uses a New Template Is Unsuccessful
> http://support.microsoft.com/default.aspx?id=281260
>
> --
> Mike
> Microsoft MVP - Windows Security
>
>
> "timB" <timB@discussions.microsoft.com> wrote in message
> news:489E3989-B07C-4EE1-9DC1-A89654743F6D@microsoft.com...
> >I am trying to set up CA in a lab enviroment to work with EFS. I am using
> >a
> > Lab enviroment, which consists of:
> >
> > A Windows 2003 DC, 2003 Excahnge server, a number of other test servers,
> > test computers and one Windows 2003 Member server. The member server is
> > running certificate service as Enterprise root CA.
> >
> > However the client computers are not getting certificates from the CA
> > (only
> > the self signed personal certificates) and I am getting the following
> > error
> > message when I look on the event viewer within the CA server:
> >
> > Certificate Services denied request 16 because The requested certificate
> > template is not supported by this CA. 0x80094800 (-2146875392). The
> > request
> > was for Domain Name\Computer Name.
> >
> > Additional information: Denied by Policy Module 0x80094800, The request
> > was
> > for a certificate template that is not supported by the Certificate
> > Services
> > policy:
> > DomainController.
> >
> > Any help would be greatly appriciated.
>
>
>

[timB]

Also, when I request a new certificate from the Certificates snap in -
Current User (Personal Certificates) I receive the following error message:

The wizard cannot be started because one of the following conditions:
- There are no trusted certification authorities (CAs) avaliable.
- You do not have the permissions to request certificates from the avalable
CAs.
- The available CAs issue certificates for which you do not have permission

[Miha Pihler [MVP]]

Hi,

What template are you trying to request?

--
Mike
Microsoft MVP - Windows Security

"timB" <timB@discussions.microsoft.com> wrote in message
news:6B1F9002-A103-4A90-94F3-C299BECF2E00@microsoft.com...
> Thanks for your help, but that did not fix this issue. Some further
> information:
>
> When I try to request a new certificate through IE and I go to 'Request
> Certificate' I receive the following error message on the page:
>
> "No certificate template could be found. You do not have permission to
> request a certificate from this CA, or an error occured while accessing
> Active Directory"
>
>
> "Miha Pihler [MVP]" wrote:
>
>> Hi Tim
>>
>> Does this help?
>>
>> A Certificate Request That Uses a New Template Is Unsuccessful
>> http://support.microsoft.com/default.aspx?id=281260
>>
>> --
>> Mike
>> Microsoft MVP - Windows Security
>>
>>
>> "timB" <timB@discussions.microsoft.com> wrote in message
>> news:489E3989-B07C-4EE1-9DC1-A89654743F6D@microsoft.com...
>> >I am trying to set up CA in a lab enviroment to work with EFS. I am
>> >using
>> >a
>> > Lab enviroment, which consists of:
>> >
>> > A Windows 2003 DC, 2003 Excahnge server, a number of other test
>> > servers,
>> > test computers and one Windows 2003 Member server. The member server is
>> > running certificate service as Enterprise root CA.
>> >
>> > However the client computers are not getting certificates from the CA
>> > (only
>> > the self signed personal certificates) and I am getting the following
>> > error
>> > message when I look on the event viewer within the CA server:
>> >
>> > Certificate Services denied request 16 because The requested
>> > certificate
>> > template is not supported by this CA. 0x80094800 (-2146875392). The
>> > request
>> > was for Domain Name\Computer Name.
>> >
>> > Additional information: Denied by Policy Module 0x80094800, The
>> > request
>> > was
>> > for a certificate template that is not supported by the Certificate
>> > Services
>> > policy:
>> > DomainController.
>> >
>> > Any help would be greatly appriciated.
>>
>>
>>

[timB]

Hi,

I have managed to resolve this issue, there was an issue with the domain.

Thanks Again,

Tim

"Miha Pihler [MVP]" wrote:

> Hi,
>
> What template are you trying to request?
>
> --
> Mike
> Microsoft MVP - Windows Security
>
> "timB" <timB@discussions.microsoft.com> wrote in message
> news:6B1F9002-A103-4A90-94F3-C299BECF2E00@microsoft.com...
> > Thanks for your help, but that did not fix this issue. Some further
> > information:
> >
> > When I try to request a new certificate through IE and I go to 'Request
> > Certificate' I receive the following error message on the page:
> >
> > "No certificate template could be found. You do not have permission to
> > request a certificate from this CA, or an error occured while accessing
> > Active Directory"
> >
> >
> > "Miha Pihler [MVP]" wrote:
> >
> >> Hi Tim
> >>
> >> Does this help?
> >>
> >> A Certificate Request That Uses a New Template Is Unsuccessful
> >> http://support.microsoft.com/default.aspx?id=281260
> >>
> >> --
> >> Mike
> >> Microsoft MVP - Windows Security
> >>
> >>
> >> "timB" <timB@discussions.microsoft.com> wrote in message
> >> news:489E3989-B07C-4EE1-9DC1-A89654743F6D@microsoft.com...
> >> >I am trying to set up CA in a lab enviroment to work with EFS. I am
> >> >using
> >> >a
> >> > Lab enviroment, which consists of:
> >> >
> >> > A Windows 2003 DC, 2003 Excahnge server, a number of other test
> >> > servers,
> >> > test computers and one Windows 2003 Member server. The member server is
> >> > running certificate service as Enterprise root CA.
> >> >
> >> > However the client computers are not getting certificates from the CA
> >> > (only
> >> > the self signed personal certificates) and I am getting the following
> >> > error
> >> > message when I look on the event viewer within the CA server:
> >> >
> >> > Certificate Services denied request 16 because The requested
> >> > certificate
> >> > template is not supported by this CA. 0x80094800 (-2146875392). The
> >> > request
> >> > was for Domain Name\Computer Name.
> >> >
> >> > Additional information: Denied by Policy Module 0x80094800, The
> >> > request
> >> > was
> >> > for a certificate template that is not supported by the Certificate
> >> > Services
> >> > policy:
> >> > DomainController.
> >> >
> >> > Any help would be greatly appriciated.
> >>
> >>
> >>
>
>
>

[cameronshove]

I know this is an old thread, but I'm having this exact same issue in a very similar environment and not having much luck resolving it elsewhere. What was the issue on your domain that you corrected to resolve this, please?

Thank you.