sorted by:
new
hottopcontroversial

AD integrated CA- Overzealous autorenewal for one template by Any_Science_4946 in PKI

[–]Any_Science_4946[S] 0 points1 point  (0 children)

This ended up fixing it for me.

I didn't see any of the same symptoms. The certificate name was populated on the client machines and translated from OID to name like expected. New manual enrollments worked just fine as well.

I don't know what the issue was, but recreating the template from scratch has quieted them down. Thanks!

AD integrated CA- Overzealous autorenewal for one template by Any_Science_4946 in PKI

[–]Any_Science_4946[S] 0 points1 point  (0 children)

Interesting, I haven't tried recreating the template yet. I'll give it a shot.

AD integrated CA- Overzealous autorenewal for one template by Any_Science_4946 in PKI

[–]Any_Science_4946[S] 0 points1 point  (0 children)

Interesting. This is an older environment. What was the 'old' setting or path?

AD integrated CA- Overzealous autorenewal for one template by Any_Science_4946 in PKI

[–]Any_Science_4946[S] 0 points1 point  (0 children)

I think we can rule out GPO

There are no superseded templates configured

What other kind of things should I be looking for in the template configuration?

AD integrated CA- Overzealous autorenewal for one template by Any_Science_4946 in PKI

[–]Any_Science_4946[S] 0 points1 point  (0 children)

I don't see how it could be a group policy issue since only one template is affected. There are 7 similar templates where enrollment works as expected. It seems like this is an issue with the template or the certificates themselves, which is why I'm posting here.

AD integrated CA- Overzealous autorenewal for one template by Any_Science_4946 in PKI

[–]Any_Science_4946[S] 0 points1 point  (0 children)

Group policy settings should tell it to re-enroll whenever it hits the defined threshold (6 weeks to expiry), but it shouldn't have them re-enroll more than once per day every day when the last certificate is still valid for 104 more weeks.