Publish a template + auto-enrollment via GPO

Auto-enrollment only works when three things line up: the template allows it, the CA publishes the template, and a GPO turns autoenroll on for the clients. Miss any one and nothing happens, silently.

1. The template

Never edit the built-in templates. Duplicate one (say Computer), give it a new name, and on the Security tab grant the target group Read, Enroll and Autoenroll. On the Subject tab, build the subject from AD so the names are consistent.

2. Publish on the CA

certutil -SetCATemplates +CorpMachineV2
# or: CA console → Certificate Templates → New → Template to Issue

3. Turn it on in a GPO

Computer Configuration → Policies → Windows Settings → Security Settings → Public Key Policies → Certificate Services Client - Auto-Enrollment. Set it to Enabled and tick "renew expired" and "update certificates that use templates".

Test on a client

gpupdate /force
certutil -pulse
certlm.msc   # the cert should appear under Personal

If it does not show up, run certutil -pulse and check the Application event log for AutoEnrollment (source: CertificateServicesClient). The most common miss is forgetting the Autoenroll permission, since Enroll alone is not enough.