User Certificate Template by Group Policy

Hi Stefano Colombo,

It appears that you've taken most of the necessary steps for autoenrollment, but there are a few additional checks you can perform:

1. Certificate Template Schema Version:
   Verify the schema version of the certificate template. If you use the "Reenroll All Certificate Holders" option, it changes the template version. After the client updates the Group Policy, the certificate template version on the certificates should match the template's version.
   
   

2. Group Policy Configuration:
   Double-check the Group Policy settings. In the Group Policy Management Editor, go to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies.
   Enable "Certificate Services Client - Auto-Enrollment," set the Configuration Model to Enabled, and select both "Renew expired certificates, update pending certificates, and remove revoked certificates" and "Update certificates that use certificate templates".
   
   

3. Force Group Policy Update:
   If the template version changes but not on the certificate, run gpupdate /force or certutil -pulse on the client to trigger an update.

4. Refresh Certificate Store:
   Refresh the Certificate Store: Refresh the certificate store on the client.

Computer Certificate autoenrollment not working - Microsoft Q&A

Configure server certificate auto-enrollment | Microsoft Learn