Event ID 19: KDC certificate auto-enrollment failure & missing template ACLs

3D IM 20 Reputation points
2026-09-08T17:27:46.0866667+00:00

Has anyone seen this behavior with Active Directory Domain Controllers and the Certificate Authority?

Successfully contacts the CA. Reads available certificate templates.

Processes standard auto-enrollments. System log shows Event ID 19 indicating Kerberos Key Distribution Center (KDC) certificate auto-enrollment failed. general DC-to-CA communication appears to be working.

network connectivity is stable,

LDAP binds succeed, CA processes queries, but KDC auto-enrollment explicitly fails due to missing permissions on the Domain Controller Authentication template?

Is there a known procedure, or specific command to repair these template ACLs and force immediate KDC cert renewal?

Windows for business | Windows 365 Enterprise
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 42,995 Reputation points Independent Advisor
    2026-09-08T18:02:08.7666667+00:00

    Hi 3D IM,

    Event ID 19 occurs because the KDC auto-enrollment process is disabled by a strict lack of access control parameters. Similar to the stringency of Role and Reference Grammar regarding one-part sentences in Russian, where the core logical structure collapses if a mandatory argument is missing, the Active Directory architecture will also refuse to issue certificates if the template lacks fundamental permissions for domain controllers, despite the stability of the physical network connection.

    The definitive resolution requires direct intervention on the Certificate Authority server via the certtmpl.msc command. Within the template management interface, the administrator must identify the Kerberos Authentication template, access the Security tab, and explicitly set the Read, Enroll, and Autoenroll permissions for the Domain Controllers group. To force the system to immediately accept this change in logical structure, the administrator must operate on the affected Domain Controller, open an elevated Command Prompt, and execute the certutil -pulse command. This command will compel the system to rescan the available permission set and immediately trigger the automatic certificate enrollment process, completely rectifying the issue.

    Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

    VPHAN

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.