Trying to configure a Win 2003 Server to use TLS server authentication . . .

Question

I am trying to
configure a Win 2003 Server to use TLS server authentication following Method 2 in KB 895443 - see below:-
Method 2: By using the Certificate Request Wizard
The following steps describe how to obtain a certificate from a Windows Server 2003 Certification Authority. You can also request a certificate from a Windows 2000
Certification Authority. Additionally, you must have Read permissions and Enroll permissions on the certificate template file to successfully request a certificate. Use this method if one or more of the following conditions are true:
You want to request a certificate from an Enterprise Certification Authority.
You want to request a certificate that is based on a template where the subject name is generated by Windows.
You want to obtain a certificate that does not require administrator approval before the certificate is issued.
To obtain a certificate, follow these steps:
Click Start, click Run, type mmc, and then click OK.
On the File menu, click Add/Remove Snap-in.
Click Add, click Certificates, and then click Add.
Click Computer account, and then click Next.
If you want to add a certificate to the local computer, click Local computer. If you want to add a certificate to a remote computer, click Another
computer, and then type the name of that remote computer in the Another computer box.
Click Finish.
In the Add Standalone Snap-in dialog box, click Close, and then click OK in the Add/Remove
Snap-in dialog box.
Under Console Root, click Certificates (Local Computer).
Note If you configured the Certificates MMC snap-in to manage a remote computer, click Certificates (servername)instead of Certificates (Local Computer).
On the View menu, click Options.
In the View Options dialog box, click Certificate purpose, and then click OK.
In the right pane, right-click Server Authentication, point to All Tasks, and then click Request New Certificate.
In the Certificate Request Wizard that starts, click Next.
In the Certificate types list, click Server Authentication, click to select the Advanced check box,
and then click Next.
In the Cryptographic Service Providers list, click Microsoft RSA SChannel Cryptographic Provider.
I get as far as step 11 and I get the error message:-
The wizard cannot be started because of one or more of the following conditions:
- There are no trusted certification authorities (CAs) available.
- You do not have the permissions to request certificates from the available CAs.
- The available CAs issue certificates for which you do not have permissions.
This is covered in KB 927066 – see below:-
To resolve the problem, follow these steps:
Verify that the CERTSVC_DCOM_ACCESS group exists in the domain that hosts the certification authority. This group is in the CN=Users container.
To do this, follow these steps:
Click Start, click Run,
type Dsa.msc, and then click OK.
In the left pane, click the Users container.
Verify that the CERTSVC_DCOM_ACCESS group is in the right
pane. If the CERTSVC_DCOM_ACCESS group is not in the right pane, go to step 4.
Verify that the CERTSVC_DCOM_ACCESS group includes the following member groups:
Domain Users
Domain Computers
If these member groups do not exist in the CERTSVC_DCOM_ACCESS group, go to step 4. 
Note If users or computers in other domains need to enroll against the certification authority, you must also add those users and computers to the CERTSVC_DCOM_ACCESS group. If the current problem occurs on a domain
controller, you must also add the Enterprise Domain Controllers group to the CERTSVC_DCOM_ACCESS group. By default, domain controllers are not members of the Domain Computers global group. Therefore, domain controllers
do not have sufficient DCOM permissions.
Verify that the CERTSVC_DCOM_ACCESS group has the appropriate DCOM Access permissions and DCOM Launch and Activation permissions on the computer that hosts the certification
authority.
Click Start, point to Program,
point to Administrative Tools, and then click Component Services.
Expand the Component Services node.
Expand the Computers node.
Right-click the My Computer node, and
then click Properties.
Click the COM Security tab.
Under Access Permission, click Edit
Limits.
Verify that the CERTSVC_DCOM_ACCESS group has Allow Local Access and Allow
Remote Access permissions, and then click Cancel.
Under Launch and Activation Permissions, click Edit
Limits.
Verify that the CERTSVC_DCOM_ACCESS group has Allow Local Activation and Allow
Remote Activationpermissions, and then click Cancel.
Click Cancel, and then close the Component
Services console.
Settings may be incorrect if any one of the following conditions is true:
The CERTSVC_DCOM_ACCESS group does not exist.
The default membership of the CERTSVC_DCOM_ACCESS group is incorrect.
The CERTSVC_DCOM_ACCESS group does not have the correct permissions.
If any one setting is incorrect, run the following commands at a command prompt. Press ENTER after each command.
certutil -setreg SetupStatus -SETUP_DCOM_SECURITY_UPDATED_FLAG
net stop certsvc
net start certsvc
Repeat steps 1 through 3 to verify that all the settings are correct.
Note If the changes affect the group membership of the certification authority server, you must restart the server for the changes to take effect.
The only part of the above instructions which I have not been able to complete is:-
“you must also add the Enterprise Domain Controllers group to the CERTSVC_DCOM_ACCESS group”.
When I click on the CERTSVC_DCOM_ACCESS user then click the Members tab & go to add Enterprise Domain Controllers the option is not there.

Answer 1

Hi Nick,
Have you successfully set up an enterprise CA?
If yes, is the enterprise CA’s certificate located under the Trusted Root Certification Authorities store?
Best Regards,
Amy