When we installed our CA we received an error: "Windows could not install the new certificate templates. Insufficient access rights to perform the operation." I checked the services node and all the templates were present, so figured the error was an anomoly. Now when we try to manage templates, we get the following: "Windows has detected that new certificate templates should be installed. Do you want to install them?" When we click yes, we get: "Windows could not install the new certificate templates. Insufficient access rights to perform the operation." again. I have validated all the permissions are the same (other than domain names) as our lab install, and everything is configured using the same rights and sop. We have domain and enterprise admin rights, which mirror our lab rights. Can anyone point me in the direction to fix this? Thanks, Jay

Hi Jay, Thanks for posting in Microsoft TechNet forums. I think the problem can still be related to permission. We can follow the article below to double-check the permission settings. Deploying Certificate Templates http://technet.microsoft.com/en-us/library/cc770794(v=ws.10).aspx Have a nice day. Regards Kevin

Kevin, Thank you for the link. I am missing the Certificate Publishers group in my production domain. In my lab it exists in the forest root, but not in the child Domain. I am looking for a sop to correct this issue, but if you have a link handy it would be appreciated. Thanks, Jay

Scratch that, I found the group. It had been moved from the default locations and exists, but is at the 2000 level of permissions. I found an article that should help with this. http://morgansimonsen.wordpress.com/2012/01/24/an-overview-of-groups-used-by-active-directory-certificate-services/ Thanks for your help, you pointed me in the correct direction. Jay