Certificate enrollment web servce GPO enablement failure

Question

2012 Std R2
Added certificate authority role with web services
configuring via library hh831625
I have verified that IIS has the default site ADPolicyProvider_CEP_Kerbos and I copied the URI <a href="https:///ADPolicyProvider_CEP_Kerbos/service.svc/CEP">https://<server>/ADPolicyProvider_CEP_Kerbos/service.svc/CEP
I added a domain GPO per directions Certificate Enrollment Policy Web Services. I am editing the GPO for Computer->Policies->Windows Settings-> Security Settings->Public Key Policies. I double click Certificate Services Client - Certificate
Enrollment Policy. I enable the policy and ADD certificate enrollment policy list. I paste the above URI, Authentication type is "Windows Integrated". When I validate server I get the following error:
An error occurred while obtaining certificate enrollment policy
URI:https://<server>/ADPolicyProvider_CEP_Kerbos/services.svc/CEP
Error: The remote endpoint does not exist or could not be located. 0x803d00d (-21434855939 WS_E_ENDPOINT_NOT_FOUND)
Help with this final validation is appreciated. Logged on as administrator with domain admin rights and enterprise Admins rights
John Lenz

Answer 1

Hi,
Please try to do the following steps at first. Thanks.
Configuring the CEP web address in the client
Before I go into the steps it is important to understand that this configuration is based on the security context. You have a CEP configuration for the user, and you have another configuration for the computer. Depending on what certificates you plan on
issuing (user or computer certificates) you may only require one of these to be configured.
Configuring user certificate enrollment
Run CertMgr.msc.
Expand Certificates, then Current User.
Expand Personal.
Right click on Personal, and select All Tasks, then
Advanced Operations, then Manage Enrollment Policies…
On the Manage Enrollment Policies dialog click the Add… button. See Figure 12
Type in the URI for the CEP service in the field. This will be in the format of:
https://<Internet FQDN>/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP
In my example this would be:
https://cert-enroll.fabrikam.com/ADPolicyProvider_CEP_UsernamePassword/service.svc/CEP
NOTE: the only thing that will be unique to your environment is the Internet FQDN of the URI.
In the Authentication type drop down select: Username/password
Click the Validate button.
Once the Validate button is pressed, you will be prompted to type in a domain user name and password. Supply these credentials.
If everything goes correctly you should see that the validation test passed in the lower section of the dialog box see Figure 13.
NOTE: You can see in Figure 13 that the only difference is the DNS portion of this URI. If you scroll down further in the validation output, you will see the friendly name you added under the website configuration being displayed also.
Click the Add button.
Uncheck Enable for automatic enrollment and renewal.
NOTE: Failure to do so could cause users to be prompted for user name and password each time they logon to the computer. This occurs because Windows Autoenrollment runs immediately after the user has logged on. If the enrollment policy is configured for automatic
enrollment and renewal, Windows Autoenrollment will attempt to contact the configured CEP server when it starts in order to determine if new certificates have been assigned. Since this will result in the users being prompted for credentials every time they
log on your users may be annoyed.
Click the OK button.NOTE: Follow the same procedures to configure the Enrollment Policy server for the computer personal store if you need to enroll for computer certificates.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.