No templates are shown in the Template folder of the Certificate Authority.
In the Certificate Templates (certtmpl.msc) are Templates shown.
Running certutil -CATemplates returns 0x80070490 (WIN32: 1168 ERROR_NOT_FOUND) CertUtil: Element not found.
Restarting the service did not help
Sreenshot of CN=OID shows the following result
There are also no entries under CN:Enrollment Services
It looks like that your templates are ok and OIDs are ok as well.
Try to restart certificate service (certsvc) on new CA and check if templates are loaded. If this doesn't help, then stop certsvc on CA, then remove templates in CA record under CN=Enrollment Services, CN=Public Key Services, CN=Services,{configurationNamingContext}. Open CA record, navigate to certificateTemplates attribute:
certsrv.msc), start certsvc and try to add templates manually from the record you made in step 1.
Answer crossposted from here: https://serverfault.com/a/852474/332852
I recently moved my Enterprise CA from a Server 2019 DC to a dedicated Server 2022 system. Unfortunately after the migration I had several issues because I followed a third party guide instead of the official Microsoft guide. The microsoft guide included a couple of important pieces of information about keep the name of the server the same (or making changes to reflect the change) and publishing CRLs to the old namespace.
The other thing that happened apparently is that the flags for our CA were not properly designating our CA as enterprise.
After you have verified that you actually have an Enterprise CA, let’s look at the CA object in ADSIEdit.msc and make sure the flag that identifies it as an Enterprise CA is set correctly. It is very unusual to see the flag set incorrectly, but all the same it is possible. As we did before, launch ADSIEdit.msc, then expand CN=Configuration | CN=Services | CN=Public Key Services | CN=Enrollment Services. Right click the CA in the right pane that you want to enroll from and click properties. Find the flags attribute; and verify that it is set to 10. If it isn’t set to 10, then set it to 10 using ADSIedit.msc and allow for Active Directory replication to complete.
Our flag was set to 2. I stopped the CertSvc, changed the flag to 10, restarted the CertSvc and presto chango, the templates were available again.
I had similar issues and the above helped solve it. When I checked permissions of each template, I found that these did not have Enterprise Admins and Domain Admins on all of them.
so deleted them all from ADSIEDIT.msc The ran certutil -installdefaulttemplates from the certificate server to recreate the default certificate templates. If you have any custom certificates, you might want to check and just add permissions to them instead.
