Device certificate Autoenrollment using onprem RA into a subdomain of a onprem Active Directory Domain fails.

[bergstiefelbene]

Hi,
I try to do certificate autoenroll over RA which is onprem into a subdomain of an onprem Active Directory Domain.

I got this error on a device which is added into a group of a GPO that is pointing to that system:

0x803d0013 (-2143485933 WS_E_ENDPOINT_FAULT_RECEIVED
In this environment the service account is in the parent active directory and the system is in the subdomain.

A manual enrol is working. I tried a lot but without success. Can anyone give me an idea please.

The EJBCA-RA setting for the Autoenrollment is set like this:
Use SSLSet to true if the LDAP connection should use SSL. | Use
Follow LDAP ReferralEnable if LDAP queries should follow referrals in AD. | Use

[primetomas]

Microsoft Autoenrollment is an Enterprise feature in EJBCA. If this is an enterprise support request, please post to the Keyfactor support portal.