Auto-Enrollment Security Review Worksheet
A practical worksheet for reviewing Microsoft ADCS auto-enrollment configuration, GPO settings, certificate template permissions, enrollment agent controls, and client certificate deployment risk.
Certificate auto-enrollment is one of the most powerful features in Microsoft ADCS. When configured correctly, it enables scalable certificate deployment for users, computers, domain controllers, Wi-Fi, VPN, smart cards, S/MIME, and other enterprise use cases. When configured poorly, auto-enrollment can unintentionally issue certificates to the wrong principals, expand authentication risk, create certificate sprawl, or expose template misconfigurations.
This worksheet is designed to help PKI administrators, security teams, and auditors review the full auto-enrollment path — from Group Policy through certificate template permissions and client enrollment behavior.
What This Worksheet Reviews
Recommended Review Workflow
Identify all auto-enrollment GPOs
Search Group Policy Objects in the domain for GPOs that configure Certificate Services Client — Auto-Enrollment settings. Use GPMC or PowerShell to enumerate GPOs with auto-enrollment configuration.
Document where each GPO is linked
Record the OU, domain, or site where each auto-enrollment GPO is linked. Note whether the link is enabled and whether enforcement or block inheritance is applied.
Confirm whether the GPO targets users, computers, or both
Auto-enrollment can be configured separately for user certificates and computer certificates. Confirm which policy applies to which scope and whether both are intentional.
Review security filtering and WMI filtering
Confirm that GPO security filtering is intentional. Broad security filtering such as Authenticated Users applying auto-enrollment GPOs to all users or computers in an OU may be wider than intended.
Identify all certificate templates published on the issuing CA
Open the Certification Authority console, expand Certificate Templates, and list all published templates. Templates published on the CA are available for enrollment — unpublish templates that are no longer needed.
Identify which templates have Autoenroll permission enabled
For each published template, open the template properties in the Certificate Templates console and review the Security tab. Identify which security principals have the Autoenroll permission.
Review who has Enroll and Autoenroll rights
Document every security principal with Enroll or Autoenroll permission on each template. Pay particular attention to broad groups and built-in groups.
Look for overly broad permissions
Flag templates where any of the following have Enroll or Autoenroll permission:
- Authenticated Users
- Domain Users
- Domain Computers
- Everyone
- Overly broad nested groups
Review template purpose, EKUs, subject name settings, private key settings, and issuance requirements
For each template with broad permissions, review the full template configuration — EKUs, subject name source, private key exportability, key usage, issuance requirements, and renewal settings.
Validate whether issued certificates match the intended business use case
Review recently issued certificates from the CA. Confirm that the subject, SAN, EKU, and issuing template match the intended business purpose. Look for unexpected issuances.
Test enrollment from a pilot user or computer
Move a test account or computer to a pilot OU or pilot group. Run gpupdate /force and certutil -pulse. Verify the correct certificate was issued with the expected attributes.
Document findings, risk level, owner, and remediation actions
Record each finding in the Findings Worksheet (Section 10). Assign a risk level, document the business impact, identify the owner, and set a target remediation date.
Auto-Enrollment GPO Review Checklist
| Review Item | Expected Configuration | Actual Configuration | Risk Level | Notes / Remediation |
|---|---|---|---|---|
| Auto-enrollment GPOs identified | All GPOs documented | High | ||
| GPO link locations documented | All link OUs recorded | Medium | ||
| User auto-enrollment enabled only where needed | Scoped to required OUs | High | ||
| Computer auto-enrollment enabled only where needed | Scoped to required OUs | High | ||
| GPO security filtering reviewed | Intentional, not overly broad | High | ||
| WMI filtering reviewed | Documented or confirmed not in use | Medium | ||
| Block inheritance checked on target OUs | Documented where applied | Medium | ||
| Enforced GPOs identified | Documented and intentional | Medium | ||
| Conflicting GPOs identified | No unintended conflicts | Medium | ||
| Auto-enrollment renewal behavior reviewed | Renewal configured appropriately | Low | ||
| Expired certificate cleanup behavior reviewed | Cleanup enabled where appropriate | Low | ||
| Certificate Services Client settings reviewed | Consistent with policy intent | Medium | ||
| Pilot OU or pilot group available for testing | Pilot group exists | Low | ||
| Production rollout scope documented | Scope and impact documented | Medium |
Certificate Template Permission Review
Complete one row per certificate template published on the issuing CA. Pay particular attention to templates with Autoenroll permission granted to broad groups.
| Template Name | Intended Use | Enroll Groups | Autoenroll Groups | Broad Permissions | Risk Level | Recommended Action |
|---|---|---|---|---|---|---|
- Identify templates with Autoenroll permission
- Identify templates with Enroll permission
- Check whether Authenticated Users has Enroll or Autoenroll
- Check whether Domain Users has Enroll or Autoenroll
- Check whether Domain Computers has Enroll or Autoenroll
- Check whether high-risk templates are limited to dedicated security groups
- Confirm template ownership
- Confirm template purpose
- Confirm whether templates are still required
- Confirm whether legacy templates should be retired
High-Risk Template Settings to Review
Enrollment Agent Review
- Identify all Enrollment Agent certificate templates published on the CA
- Identify all users or groups with enrollment agent rights
- Confirm the Certificate Request Agent EKU is present only on intended templates
- Confirm whether enrollment agent restrictions are configured on the CA
- Confirm whether enrollment on behalf of another user is actually required
- Confirm whether issuance requires approval for enrollment agent requests
- Confirm whether enrollment agent usage is logged and reviewed
- Confirm whether access is limited to dedicated PKI or security personnel
- Review CA enrollment agent restrictions — which agents can enroll for which templates and which subjects
- Confirm enrollment agent certificates are stored securely and access is controlled
EAP-TLS / Wi-Fi / VPN Auto-Enrollment Review
Auto-Enrollment Testing Checklist
- Move test machine or user to pilot OU or pilot group
- Run gpupdate /force
- Review certificate auto-enrollment event logs
- Run certmgr.msc for user certificate store
- Run certlm.msc for computer certificate store
- Confirm correct certificate template was issued
- Confirm certificate chain builds correctly
- Confirm CDP and AIA are reachable from the client
- Confirm certificate includes correct EKU
- Confirm certificate subject and SAN are correct
- Confirm private key exists and is not exportable if required
- Test intended use case — Wi-Fi, VPN, smart card, or application authentication
Event Logs to Review
Auto-enrollment troubleshooting should include both client-side enrollment logs and CA-side issuance or denial events.
- Event Viewer → Applications and Services Logs → Microsoft → Windows → CertificateServicesClient-AutoEnrollment
- CertificateServicesClient-CertEnroll
- System log — certificate-related events
- Application log — relevant enrollment events
- CA server Security log — certificate issuance and denial events
- Certification Authority log — issued, pending, failed, and revoked certificates
- CA server Application log — service events
- CA server System log — relevant service events
Findings Worksheet
Document each finding below. Assign a risk level, identify the owner, and track remediation status.
| Finding ID | Area | Issue | Evidence | Risk Level | Business Impact | Recommended Remediation | Owner | Target Date | Status |
|---|---|---|---|---|---|---|---|---|---|
| AE-001 | GPO | High | |||||||
| AE-002 | Template Permissions | Critical | |||||||
| AE-003 | Enrollment Agent | High | |||||||
| AE-004 | Private Key | Medium | |||||||
| AE-005 | EAP-TLS | Medium |
Remediation Guidance
- Remove broad enrollment permissions from sensitive templates — replace Authenticated Users or Domain Users with dedicated security groups
- Use dedicated security groups for auto-enrollment — not built-in groups
- Pilot changes before production rollout — test in a pilot OU or pilot group first
- Disable or retire unused templates — unpublish from the CA and disable in the template store
- Disable exportable private keys where not required — document any exceptions
- Add approval requirements for high-risk templates — manager approval or authorized signatures
- Restrict enrollment agent permissions — limit to dedicated PKI or security personnel
- Document template ownership — assign a named owner for each published template
- Monitor certificate issuance — review CA logs regularly for unexpected issuances
- Validate new certificates after template changes — test from a pilot account before broad rollout
- Communicate changes to endpoint, identity, and network teams — auto-enrollment changes affect Wi-Fi, VPN, smart card, and application authentication
Download the Worksheet
Download the Auto-Enrollment Security Review Worksheet
Use this worksheet to document auto-enrollment GPOs, certificate template permissions, enrollment agent settings, testing results, and remediation actions. Available in PDF and XLSX formats.
Need help reviewing Microsoft ADCS auto-enrollment?
InsecurePlanet can help assess auto-enrollment GPOs, certificate templates, enrollment permissions, client certificate behavior, and enterprise PKI risk.