Permissions error during Cross-Forest Cert enrollment

Question

Hello,
When attempting to manually enroll for a Cert on a 2012 R2 server, I get the 'Certificate types are not available' msg with the 'You cannot request a cert at this time because no certificate types are available' msg.  When I click the 'Show all templates'
box, all the cert types are shown with a Status: Unavailable and the msg 'The permissions on the certificate template do not allow the current user to enroll for this type of cert'.
In this instance, the CA infrastructure is in the Resource forest with the server attempting a cert enroll in the Account forest.  Both Forests are 2008 R2 with a two-way Forest Trust.  We followed all steps in the 'Cross-forest Certificate Enrollment
with Windows Server 2008 R2' doc published by Microsoft with no issues.  The PKISync worked fine and we do see the Root and SubCA1 certs on the machine we are trying to manually enroll a cert on.  We implemented all the steps to ensure this machine
receives a cert the same way machines in the Resource forest receive certs.  We've validated the base Trust/Network infrastructure and all checks out.  However, the Resource root forest and domain is all one and on the same domain controllers whereas
the Account forest has the classical Forest root with two separate domain controllers and then a child domain with a number of domain controllers.  The child domain is where the server lives which we are trying to manually enroll a cert.
As a point of clarification, the server computer account was added to a Global Security group in the Account Forest.  This group was added to a Domain Local Security group in the Resource Forest which has the Read/Enroll/AutoEnroll permissions on the
Cert Template.
Any suggestions on what could be causing the permissions errors?
Thanks for your help! SdeDot

Answer 1

Certificate Template permissions can never be assigned to a Domain Local group, only to Universal or Global groups.
The correct strategy in a multi-forest scenario is the following:
1) Create a universal group for the certificate template in the account forest (say
Accountdomain\pki-authcert-u)
2) Create a universal group for the certificate template in the resource forest (say Resourcedomain\pki-authcert-u)
3) Create multiple global groups in each domain in the account forest (if three domains in the forest, create three global groups - one in each domain). Then add the user accounts to the global group in the same domain)
4) Create multiple global groups in each domain in the resource forest (if three domains in the forest, create three global groups - one in each domain). Then add the user accounts to the global group in the same domain)
5) On the certificate template, assign the two universal groups Read, Enroll, (and Autoenroll) permissions. That is both Accountdomain\pki-authcert-u and Resourcedomain\pki-authcert-u
6) Run the pkisync.ps script again to replicate the new permissions
The reason you cannot use domain local groups is that the certificate template is stored in the Configuration naming context which is replicated to each domain in the forest (account or resource in your case).
A domain local group can only be used in the domain where the group exists (not good for PKI objects in the configuration NC.
Brian