Windows Server 2012 CA will not allow Windows XP to autoenroll

Question

I have a Windows Server 2012 Domain Controller with an Enterprise root CA installed.  I have created a client authentication certificate template (2003 compatible).  Domain Computers have Read, Enroll and Autoenroll permissions.  I modified
the Domain Policy to enable Certificate autoenrollment.  I have two clients on the same subnet with the domain controller, one Windows 7 Ent SP1 and one Windows XP SP3.  The problem:  Windows 7 reboots, has client auth cert installed in computer's
personal cert store.  The Windows XP machine cannot acquire the certificate.  Event ID 13, source is AutoEnrollment, 0x80094011,The permissions on this certification authority do not allow the current user to enroll for certificates.  Both machines
belong to the domain.  Running gpudate /force on the XP machine generates an info event stating that the computer security policy has be applied successfully, then the autoenrollment error.  I've setup autoenrollment dozens of times without any
problems.  The only thing different in this environment is that the CA is installed on Server 2012.  I could be something else, but the only real difference is Server 2012.  There are no errors on the server.  It is like the client just
cannot talk to the server at all, but it's getting its policy from that server.
Any ideas? 

Answer 1

http://technet.microsoft.com/en-us/library/hh831373.aspx
What works differently?
Windows XP clients
will not be compatible with this higher security setting enabled by
default on a Windows Server 2012 CA. If necessary, you can lower the
security setting as previously described.
Try run this command:
certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST
Restart the certification authority
net stop certsvc
net start certsvc
INFO FROM LINK:
What value does this change add?
The CA
enforces enhanced security in the requests that are sent to it. This
higher security level requires that the packets requesting a certificate
are encrypted, so they cannot be intercepted and read. Without this
setting enabled, anyone with access to the network can read packets sent
to and from the CA using a network analyzer. This means that
information could be exposed that might be considered a privacy
violation, such as the names of requesting users or machines, the types
of certificates for which they are enrolling, the public keys involved,
and so on. Within a forest or domain, leaking these data may not be a
concern for most organizations. However, if attackers gain access to the
network traffic, internal company structure and activity could be
gleaned, which could be used for more targeted social engineering or
phishing attacks.
The commands to enable the enhanced security
level of RPC_C_AUTHN_LEVEL_PKT on Windows Server®  2003,
Windows Server®  2003 R2, Windows Server®  2008, or Windows
Server 2008 R2 certification authorities are:
certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST
Restart the certification authority
net stop certsvc
net start certsvc
If
you still have Windows XP client computers that need to request
certificates from a CA that has the setting enabled, you have two
options: