If you want to display a list (in the command line) of certificate templates that are on offer by your friendly Active Directory Certificate Services CA, use certutil -CATemplates
.
C:\Windows\system32>certutil -CATemplates
DirectoryEmailReplication: Directory Email Replication -- Auto-Enroll: Access is denied.
DomainControllerAuthentication: Domain Controller Authentication -- Auto-Enroll: Access is denied.
KerberosAuthentication: Kerberos Authentication -- Auto-Enroll: Access is denied.
EFSRecovery: EFS Recovery Agent -- Auto-Enroll: Access is denied.
EFS: Basic EFS -- Auto-Enroll: Access is denied.
DomainController: Domain Controller -- Auto-Enroll: Access is denied.
WebServer: Web Server -- Auto-Enroll: Access is denied.
Machine: Computer -- Auto-Enroll: Access is denied.
User: User -- Auto-Enroll: Access is denied.
SubCA: Subordinate Certification Authority -- Auto-Enroll: Access is denied.
Administrator: Administrator -- Auto-Enroll: Access is denied.
CertUtil: -CATemplates command completed successfully.
Bonus, it also tells you whether you currently have the right to enroll for each particular template.
To enroll in one of the certificate templates, use:
certreq -enroll -q WebServer
The -q
parameter suppresses all interactive dialog boxes, making it a purely command-line-only experience.