(Re-)Installing the Microsoft Standard Certificate Templates

There may be cases where it is necessary to install the standard Microsoft certificate templates before installing the first Active Directory integrated certificate authority (Enterprise Certification Authority), or to reinstall the templates, for example because they have been corrupted or otherwise modified.

The following standard certificate templates are defined:

Object name	Display name (English)	Anzeigename (Deutsch)
Administrator	Administrator	Administrator
CA	Root Certification Authority	Master Certification Authority
CAExchange	CA Exchange	Certification Authority exchange
CEPEncryption	CEP Encryption	CEP-Verschlüsselung
ClientAuth	Authenticated Session	Authentifizierte Sitzung
CodeSigning	Code Signing	Code signature
CrossCA	Cross Certification Authority	Übergreifende Zertifizierungsstelle
CTLSigning	Trust List Signing	Vertrauenslistensignatur
DirectoryEmailReplication	Directory Email Replication	Verzeichnis-E-Mail-Replikation
DomainController	Domain controller	Domain controller
DomainControllerAuthentication	Domain Controller Authentication	Domänencontrollerauthentifizierung
EFS	Basic EFS	Basis-EFS
EFSRecovery	EFS Recovery Agent	EFS-Wiederherstellungsagent
EnrollmentAgent	Enrollment Agent	Registrierungs-Agent
EnrollmentAgentOffline	Exchange Enrollment Agent (Offline request)	Exchange Enrollment Agent (Offlineanforderung)
ExchangeUser	Exchange User	Exchange-Benutzer
ExchangeUserSignature	Exchange User Signature
IPSECIntermediateOffline	IPSec (Offline Request)	IPSec (Offlineanforderung)
IPSECIntermediateOnline	IPSec	IPSec
KerberosAuthentication	Kerberos Authentication	Kerberos authentication
KeyRecoveryAgent	Key Recovery Agent	Schlüsselwiederherstellungs-Agent
Machine	Computer	Computer
MachineEnrollmentAgent	Enrollment Agent (Computer)	Registrierungs-Agent (Computer)
OCSPResponseSigning	OCSP Response Signing	OCSP-Antwortsignatur
OfflineRouter	Router (Offline Request)	Router (Offlineanforderung)
RASandIASServer	RAS and IAS Server	RAS- und IAS-Server
SmartcardLogon	Smartcard Logon	Smartcard login
SmartcardUser	Smartcard User	Smartcard-Benutzer
SubCA	Subordinate Certification Authority	Untergeordnete Zertifizierungsstelle
User	User	User
UserSignature	User Signature Only	Nur Benutzersignatur
WebServer	Web Server	Web server
Workstation	Workstation Authentication	Arbeitsstationsauthentifizierung

Implementation

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

Reinstalling the certificate templates means deleting them and then creating them again. To delete them, you must have Enterprise Administrator permissions.

The deletion itself is done with the ADSI editor (adsiedit.msc).

You connect to the configuration partition.

The certificate templates are located at Services – Public Key Services…

...below CN=Certificate Templates. Here you can select all or individual certificate templates and delete them by right-clicking.

To reinstall the default certificate templates, there is a corresponding certutil command:

certutil -installdefaulttemplates

Please note that the command must be executed with Enterprise Administrator privileges.

Related links:

• Installation of the default certificate templates fails with error message "This security ID may not be assigned as the owner of this object."

External sources

• How to re-install the default certificate templates? (Microsoft, archive link)