Restricted enrollment agents

Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester."

A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
This uses the Enroll on Behalf of (EOBO) mechanism.
The certificate request fails with the following error message:

The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.


Event Source:	Microsoft-Windows-CertificationAuthority
Event ID:	21 (0x15)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_PROCESS_REQUEST_FAILED
Event text (English):	Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3.
Event text (German):	Die Anforderung %1 konnte aufgrund eines Fehlers nicht ausgeführt werden: %2. Die Anforderung bezog sich auf %3.