← All Posts

MECM

MECM (formerly SCCM) 2012 R2 — PKI Certificate Enrollment Issues

When MECM (formerly SCCM) clients aren't picking up their PKI certificates after deployment, the fix is usually in the certificate template or AD enrollment.

CertificatesMECMPKI

After deploying an image with MECM (formerly SCCM) 2012 R2, the client wasn't receiving its PKI client authentication certificate. Without it, the client couldn't communicate securely with the management point (HTTPS mode).

Root cause: The machine certificate template in Active Directory Certificate Services (ADCS) didn't have autoenrollment configured correctly, and the client's computer account didn't have the right permissions.

Resolution:

  1. In the CA, verify the Workstation Authentication certificate template has Autoenroll permission for Domain Computers
  2. Ensure Group Policy has autoenrollment enabled: Computer Config → Policies → Windows Settings → Security → Public Key Policies → Certificate Services Client - Auto-Enrollment
  3. Run certutil -pulse on the client to trigger enrollment
  4. Verify with certlm.msc → Personal → Certificates

Modern PKI note: PKI remains critical for MECM HTTPS communication, Wi-Fi/VPN authentication, and code signing. Consider deploying Enhanced HTTP (eHTTP) in MECM current branch — it uses Azure AD tokens instead of PKI for client-to-server communication, significantly simplifying certificate management.