ADCS certificate enrollment error with RPC

Question

I'm attempting to enroll in a computer certificate that works for a windows clients (W7), but not for the Apple (OS 10.9.4) clients.  I've been using the following document, with no success (http://support.apple.com/kb/HT5357).  The enrollment is being attempted from a mobileconfig generated from an OS X server.  The payload is limited to only ADCertificatePayload to limit how much to troubleshoot.  We are also limiting the enrollment to a single Issuing CA to limit where to look for communication.  I greatly appreciate any assistance you can provide.
This is the ManagedClient.log from /Library/Logs:
+||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||
Sep  3 13:44:20[562:1]:+|||||||||||||| Calling installPayload on plugin: ADCertificatePayloadPlugin ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Sep  3 13:44:20[562:1]:+|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Sep  3 13:44:20[562:1]:+ADCertificatePayloadPlugin.pdp_pluginInstallPayload
Sep  3 13:44:20[562:1]:+ADCertificatePayloadPlugin scheme overrides HTML to use RPC; scheme = (null)
Sep  3 13:44:20[562:1]:+ADCertificatePayloadPlugin using RPC = YES
Sep  3 13:44:21[562:1]:+ADCertificatePayloadPlugin.boundADInformationWithError dict =
    computerID = AppleWorkID;
    domainName = "FQDN.com";
    name = domainname;
    subject = "/CN=AppleWorkID.FQDN.com";
Sep  3 13:44:21[562:1]:+ADCertificatePayloadPlugin.credentialsForDomain domainname = domainname; username = AppleWorkID$
Sep  3 13:44:21[562:1]:+ADCertificatePayloadPlugin.getCertificateFromServer
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer credentials username = AppleWorkID$
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer gss_aapl_initial_cred status = 0
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer running as euid = 0
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer ca_name = IssuingCA
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer servername = IssuingCA.FQDN.com
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer cert_template = AppleWorkstation
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer csr length = 624
Sep  3 13:44:21[562:1]:+Using RPC authn_level: 6
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer partial_string_binding = ncacn_ip_tcp:IssuingCA.FQDN.com[]
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer using principal name:  host/IssuingCA.FQDN.com
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer dwFlags is ff
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer Calling CertServerRequest...
Sep  3 13:44:21[562:1]:+GetCertificateFromCAServer CertServerRequest return pdwRequestId = 0
Sep  3 13:44:21[562:1]:+:::::::::::::::: GetCertificateFromCAServer ERROR: CertServerRequest exception name :
Sep  3 13:44:21[562:1]:+:::::::::::::::: GetCertificateFromCAServer ERROR: CertServerRequest -2147024809
Sep  3 13:44:21[562:1]:+ADCertificatePayloadPlugin.getCertificateFromServer server returned cert = FAILED
Sep  3 13:44:21[562:1]:+**************** AD certificate getCertificateFromServer failed
Sep  3 13:44:21[562:1]:+:::::::::::::::: ADCertificatePayloadPlugin.pdp_pluginInstallPayload returning = -319
Sep  3 13:44:21[562:1]:+ADCertificatePayloadPlugin.pdp_pluginInstallPayload returning = fail
Sep  3 13:44:21[562:1]:+**************** Error: Error Domain=ConfigProfilePluginDomain Code=-319 "The 'Active Directory Certificate' payload could not be installed. The certificate request failed." UserInfo=0x7fbd4157b540 {NSLocalizedDescription=The 'Active Directory Certificate' payload could not be installed. The certificate request failed.} from: InstallPayload in ADCertificatePayloadPlugin
The template, 'AppleWorkstation' template seems to have all the settings set correctly, but I'll go through them all.
General: Both display name and template name = "AppleWorkstation"
Compatability-> CA: Windows Server 2008 R2
Compatability->Certificate recipient: Windows 7 / Server 2008r2
Request Handling->Purpose:Signature and Encryption
Cryptography->Algorthim name:RSA
Cryptography->Minimum key size:2048
Cryptography->Request hash:SHA256
Security: Both the windows and mac domain computer objects have (read,enroll, autoenroll).
Subject Name->Build from this Active Directory information: Subject name format: common name
Subject Name: Only UPN is checked
The schema version of the template is 3 and the version of the template is 100.43
Both computers are joined to the Active Directory 2008 r2 domain.  Certificate services exist within the site on their own dedicated servers.  The CA's are as follows: 1x 2012r2 for offline root and 2 x Issuing CA's. 

Answer 1

Hi Alexander,
But by group should work by desing or did I get something wrong
I am not sure that I understand this query correctly, I’ll just put it this way, feel free to correct me if I misunderstood:
Access control assignment on a group will grant corresponding permissions to all members within it, it’s called inherited permissions.
If there is a direct access control entry which assigns permissions to
single security principle belonging to the group, then the direct permissions take precedence, it’s called explicit permissions.
Well, if a security principle belongs to two/multiple groups, and each group gets conflicting permissions, then the more
restricted (deny or not allow) ones take precedence. This rule goes the same with explicit permissions, more restricted ones have higher precedence.
In addition, here are some scripting forums below for you if there are any scripting requirements:
The Official Scripting Guys Forum
http://social.technet.microsoft.com/Forums/scriptcenter/en-US/home?forum=ITCG
Windows PowerShell Forum
https://social.technet.microsoft.com/Forums/en-US/home?forum=winserverpowershell&filter=alltypes&sort=lastpostdesc
MSDN Forums
https://social.msdn.microsoft.com/Forums/en-US/home
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]