A few days ago, I ran into a problem while trying to deploy a newly created certificate template. Every time a user requested a certificate from that template, the request failed with the following error:
The requested certificate template is not supported by the CA. Denied by Policy Module 0x80094800. The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: XXXXXXXXX. CRTSRV_E_UNSUPPORTED_CERT_TYPE.
At first glance, the error looked like a template issue or a permissions problem. The template itself appeared to be configured correctly, and the target group already had both Read and Enroll permissions. In theory, that should have been enough for enrollment to work.
What caused the issue
After comparing the custom template with a default CA template, the real cause became clear: the Authenticated Users group also needed Read permissions.
That detail is easy to overlook. Even if the user or security group has the required enrollment rights, certificate enrollment can still fail if the template is not readable by Authenticated Users. In this case, the missing permission prevented the CA from processing the template correctly.
The solution
The fix was simple: grant Read permissions to Authenticated Users on the certificate template.
Once that permission was added, enrollment worked as expected and the certificate could be issued without further errors.
Why this matters
This behavior is similar to Group Policy security filtering. It is not enough that a specific user or group has access in one place; the object itself must also be visible to the broader authentication context. Certificate templates behave in the same way.
For certificate enrollment to work reliably, the template needs to be readable by Authenticated Users, even when the actual enrollment rights are assigned to a more restricted group.
What to check first
If you encounter this error again, these are the first things to verify:
- The certificate template exists and is published on the CA.
- The enrolling user or group has Read and Enroll permissions.
- The Authenticated Users group also has Read permissions.
- The template is properly linked and available through Active Directory Certificate Services.
Conclusion
In this case, the error message looked more complicated than the real problem. The template was fine, and the enrollment permissions were present, but the missing Read permission for Authenticated Users caused the enrollment to fail.
Sometimes the solution is not in the obvious permissions assigned to the user or group, but in the default access expected by the CA itself.