How to re-install the default certificate templates?

Published Jan 24 2020 01:41 PM 860 Views
Microsoft

First published on TECHNET on Aug 06, 2007

When you launch the certificate templates MMC snap-in (certtmpl.msc) for the first time, the certificate templates are installed automatically in the background. Installing the templates is independent of the availability of an enterprise CA. Enterprise Administrator permissions are required to successfully install the templates.

 

That's nice and convenient but what happens if you accidentally deleted the template objects from Active Directory? The templates can be viewed and also deleted (with appropriate permissions) through the Active Directory Sites and Services MMC snap-in (dssites.msc) or any other LDAP client can be used.

 

 

 

 

 

 

So, what to do if the templates or the OID container have disappeared? With a single command-line, you can get them back. As prerequisite to install the certificate templates you must have create child access to the template container in Active Directory which is the default setting for an enterprise administrator.

 

 

 

If you are running Windows Server 2003, use the following command with enterprise administrator permissions:

 

 

 

regsvr32 /i:i /n certcli.dll

 

 

 

If you have Windows Vista or Windows Server 2008 already in place, certutil.exe understands a new verb to re-install the templates. Certutil is included in all Windows Vista SKUs by default.

 

 

 

certutil -installdefaulttemplates

 

 

 

After performing one of the above commands you must restart the CA service.

 

 

 

The following two knowledgebase articles describe scenarios where re-installation of certificate templates can make sense:

 

 



 

%3CLINGO-SUB%20id%3D%22lingo-sub-1128392%22%20slang%3D%22en-US%22%3EHow%20to%20re-install%20the%20default%20certificate%20templates%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1128392%22%20slang%3D%22en-US%22%3E%3CP%3E%3CSTRONG%3E%20First%20published%20on%20TECHNET%20on%20Aug%2006%2C%202007%20%3C%2FSTRONG%3E%20%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3EWhen%20you%20launch%20the%20certificate%20templates%20MMC%20snap-in%20(certtmpl.msc)%20for%20the%20first%20time%2C%20the%20certificate%20templates%20are%20installed%20automatically%20in%20the%20background.%20Installing%20the%20templates%20is%20independent%20of%20the%20availability%20of%20an%20enterprise%20CA.%20Enterprise%20Administrator%20permissions%20are%20required%20to%20successfully%20install%20the%20templates.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3EThat's%20nice%20and%20convenient%20but%20what%20happens%20if%20you%20accidentally%20deleted%20the%20template%20objects%20from%20Active%20Directory%3F%20The%20templates%20can%20be%20viewed%20and%20also%20deleted%20(with%20appropriate%20permissions)%20through%20the%20Active%20Directory%20Sites%20and%20Services%20MMC%20snap-in%20(dssites.msc)%20or%20any%20other%20LDAP%20client%20can%20be%20used.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20427px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F167127iAA501EE04B96B116%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3ESo%2C%20what%20to%20do%20if%20the%20templates%20or%20the%20OID%20container%20have%20disappeared%3F%20With%20a%20single%20command-line%2C%20you%20can%20get%20them%20back.%20As%20prerequisite%20to%20install%20the%20certificate%20templates%20you%20must%20have%20create%20child%20access%20to%20the%20template%20container%20in%20Active%20Directory%20which%20is%20the%20default%20setting%20for%20an%20enterprise%20administrator.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3EIf%20you%20are%20running%20Windows%20Server%202003%2C%20use%20the%20following%20command%20with%20enterprise%20administrator%20permissions%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20font-family%3A%20'Courier%20New'%3B%22%20lang%3D%22en-US%22%3Eregsvr32%20%2Fi%3Ai%20%2Fn%20certcli.dll%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3EIf%20you%20have%20Windows%20Vista%20or%20Windows%20Server%202008%20already%20in%20place%2C%20certutil.exe%20understands%20a%20new%20verb%20to%20re-install%20the%20templates.%20Certutil%20is%20included%20in%20all%20Windows%20Vista%20SKUs%20by%20default.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20font-family%3A%20'Courier%20New'%3B%22%20lang%3D%22en-US%22%3Ecertutil%20-installdefaulttemplates%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3EAfter%20performing%20one%20of%20the%20above%20commands%20you%20must%20restart%20the%20CA%20service.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2010pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3EThe%20following%20two%20knowledgebase%20articles%20describe%20scenarios%20where%20re-installation%20of%20certificate%20templates%20can%20make%20sense%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%20style%3D%22font-size%3A%2011pt%3B%20margin%3A%200in%200in%200in%200.375in%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%20lang%3D%22en-US%22%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CBR%20%2F%3E%3CBR%20%2F%3E%3C%2FP%3E%0A%3CUL%20style%3D%22margin-top%3A%200in%3B%20margin-bottom%3A%200in%3B%20margin-left%3A%200.375in%3B%20direction%3A%20ltr%3B%20unicode-bidi%3A%20embed%3B%22%20type%3D%22disc%22%3E%0A%3CUL%20style%3D%22margin-top%3A%200in%3B%20margin-bottom%3A%200in%3B%20margin-left%3A%200.375in%3B%20direction%3A%20ltr%3B%20unicode-bidi%3A%20embed%3B%22%20type%3D%22disc%22%3E%0A%3CLI%20lang%3D%22en-US%22%20style%3D%22margin-top%3A%200px%3B%20margin-bottom%3A%200px%3B%20vertical-align%3A%20middle%3B%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20You%20receive%20an%20error%20message%2C%20and%20event%20ID%2053%20is%20logged%20when%20a%20client%20computer%20requests%20a%20certificate%20from%20a%20Windows%20Server%202003%20SP1-based%20CA%20%3C%2FSPAN%3E%20%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20(%20%3C%2FSPAN%3E%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F932457%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%20%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F932457%20%3C%2FSPAN%3E%20%3C%2FA%3E%20%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20).%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%20style%3D%22margin-top%3A%200in%3B%20margin-bottom%3A%200in%3B%20margin-left%3A%200.375in%3B%20direction%3A%20ltr%3B%20unicode-bidi%3A%20embed%3B%22%20type%3D%22disc%22%3E%0A%3CLI%20lang%3D%22en-US%22%20style%3D%22margin-top%3A%200px%3B%20margin-bottom%3A%200px%3B%20vertical-align%3A%20middle%3B%22%3E%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20color%3A%20teal%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20Event%20ID%2077%20is%20logged%20in%20the%20Application%20log%20when%20the%20CertSvc%20service%20starts%20on%20a%20CA%20server%20that%20is%20running%20Windows%20Server%202003%20with%20Service%20Pack%201%20%3C%2FSPAN%3E%20%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20(%20%3C%2FSPAN%3E%20%3CA%20href%3D%22http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F931354%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3E%20%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20http%3A%2F%2Fsupport.microsoft.com%2Fkb%2F931354%20%3C%2FSPAN%3E%20%3C%2FA%3E%20%3CSPAN%20style%3D%22font-size%3A%2010pt%3B%20font-family%3A%20'Lucida%20Sans%20Unicode'%3B%22%3E%20).%20%3C%2FSPAN%3E%3C%2FLI%3E%0A%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-1128392%22%20slang%3D%22en-US%22%3E%3CP%3EFirst%20published%20on%20TECHNET%20on%20Aug%2006%2C%202007%20%26nbsp%3B%20When%20you%20launch%20the%20certificate%20templates%20MMC%20snap-in%20(certtmpl.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1128392%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ECarstenKinder%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Version history
Last update:
‎Feb 20 2020 02:42 PM
Updated by: