(Re-)Installing the Microsoft Standard Certificate Templates

There may be cases where it is necessary to install the standard Microsoft certificate templates before installing the first Active Directory integrated certificate authority (Enterprise Certification Authority), or to reinstall the templates, for example because they have been corrupted or otherwise modified.

The following standard certificate templates are defined:

Object name	Display name (English)	Display Name (German)
Administrator	Administrator	Administrator
CA	Root Certification Authority	Master Certification Authority
CAExchange	CA Exchange	Certification Authority exchange
CEPEncryption	CEP Encryption	CEP Encryption
ClientAuth	Authenticated Session	Authenticated Session
CodeSigning	Code Signing	Code signature
CrossCA	Cross Certification Authority	Cross-Sector Certification Body
CTLSigning	Trust List Signing	Trusted List Signature
DirectoryEmailReplication	Directory Email Replication	Directory Email Replication
DomainController	Domain controller	Domain controller
DomainControllerAuthentication	Domain Controller Authentication	Domain Controller Authentication
EFS	Basic EFS	Basic EFS
EFSRecovery	EFS Recovery Agent	EFS Recovery Agent
EnrollmentAgent	Enrollment Agent	Registration Agent
EnrollmentAgentOffline	Exchange Enrollment Agent (Offline request)	Exchange Enrollment Agent (Offline Request)
ExchangeUser	Exchange User	Exchange users
ExchangeUserSignature	Exchange User Signature
IPSECIntermediateOffline	IPSec (Offline Request)	IPSec (Offline Request)
IPSECIntermediateOnline	IPSec	IPSec
KerberosAuthentication	Kerberos Authentication	Kerberos authentication
KeyRecoveryAgent	Key Recovery Agent	Key Recovery Agent
Machine	Computer	Computer
MachineEnrollmentAgent	Enrollment Agent (Computer)	Registration Agent (Computer)
OCSPResponseSigning	OCSP Response Signing	OCSP Response Signature
OfflineRouter	Router (Offline Request)	Router (Offline Request)
RASandIASServer	RAS and IAS Server	RAS and IAS Servers
SmartcardLogon	Smartcard Logon	Smartcard login
SmartcardUser	Smartcard User	Smart Card Users
SubCA	Subordinate Certification Authority	Subordinate Certification Authority
User	User	User
UserSignature	User Signature Only	User signature only
WebServer	Web Server	Web server
Workstation	Workstation Authentication	Workstation Authentication

Implementation

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

Reinstalling the certificate templates means deleting them and then creating them again. To delete them, you must have Enterprise Administrator permissions.

The deletion itself is done with the ADSI editor (adsiedit.msc).

You connect to the configuration partition.

The certificate templates are located at Services – Public Key Services…

...below CN=Certificate Templates. Here you can select all or individual certificate templates and delete them by right-clicking.

To reinstall the default certificate templates, there is a corresponding certutil command:

certutil -installdefaulttemplates

Please note that the command must be executed with Enterprise Administrator privileges.

Related links:

• Installation of the default certificate templates fails with error message "This security ID may not be assigned as the owner of this object."

External sources

• How to re-install the default certificate templates? (Microsoft, archive link)