Scenario
We have a forest root, lets call ForestA.local.
We then have a sub domain in this forest. Lets call it Domain.ForestA.local. All user / computer accounts etc are in this domain. This is the main domain used by the company.
We have another forest, lets call ForestB.local.
Both forests are running as Server 2008R2
We have setup a 2 tier Enterprise CA in domain.forestA.local. This works well for users and computers in that domain. We also want to use this CA for certificates in ForestB.local domain, so we set up a 2 way forest trust between ForestA.local and ForestB.local.
I then performed the steps as described in https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/ff955845(v=ws.10) starting at step 5.
Namely:
Enabled LDAP referrals
Added CA computer accounts to Cert Publishers group in ForestB.local
Published the root CA certificate to ForestB.local
Published the enterprise CA certificate to ForestB.local
changed permissions on templates to allow enrollment for users and computers in ForestB
Used PKISync.ps1 to copy the templates from ForestA to ForestB
Now when on a machine in ForestB.local domain, I use the Certificates snap in to request a new test web certificate. The certificate templates display correctly. However, once i hit submit I get the following error
Certificate enrollment for Local system failed in authentication to all urls for enrollment server associated with policy id: {D322F504-F793-432D-84D8-128274ECC1C3} (Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)). Failed to enroll for template:
xxxxxxxxxxxxx
I have tried giving every permission including adding domain users and computers to the local Certificate Service DCOM Access group on the Enterprise CA server however still the same issue exists.
I have also spent hours googling this problem however doesnt seem to be alot out there for this particular problem.
Anyone have any ideas?
@alanburchill