I setup AD CS on a domain server and then configure the server as a enterprise CA, I then to the default GPO autoenrollment for the users. After this i then assigned a certificate template to the enterprise CA on the domain server. When I add the authenticated user group I want to permit for autoenrollment I only have the options for Read, Enroll, allow. I do not have the option for allow Autoenroll in the permissions. I have bee using the technet article as a guide. http://technet.microsoft.com/en-us/library/dd379539(v=ws.10)

Security sub forum would be the best place to ask this question. http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threadsPress any key... What the ... Where's any key ? This posting is provided "AS IS" with no warranties or guarantees and confers no rights. About Me ?

Security sub forum would be the best place to ask this question. http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threadsPress any key... What the ... Where's any key ? This posting is provided "AS IS" with no warranties or guarantees and confers no rights. About Me ?

Most likely the certificate template you are using is version 1. Try duplicating the template to generate version 2. You can use the links below for more information: http://technet.microsoft.com/en-us/library/cc787781(v=WS.10).aspx http://technet.microsoft.com/en-us/library/cc725838.aspx Cheers, RaminCheers, Ramin

Thanks guys I'll resubmit to the security forum if the v2 template does the same thing