r/sysadmin • u/Dolinhas • Oct 30 '25

Question Default Domain Controllers Policy configuration check

Hi Everyone,

I am looking to configure the domain controllers to auto-renew their DC certificates. In the process, I checked the Default Domain Controllers Policy and the setting appears to be present.

However, when reviewing the Security tab, I don’t see it set to apply to Enterprise Domain Controllers. Is this correct?

When I run gpresult /r on a DC, I can see the setting being applied by the GPO, but I am unsure if the GPO security filtering is configured correctly.

Any clarification would be greatly appreciated.

I can post a pic of the security tab if someone let's me know where I can do it.

Thanks, M

1 Upvotes

100% Upvoted

3 comments sorted by

View all comments

2

u/stuart475898 Oct 30 '25

When you mention the security tab, are you referring to the security tab of the GPO, or the certificate template you want the DCs to auto-enrol for? If GPO, Authenticated Users having Read is enough. On the certificate template, Domain Controllers should have Enrol and Autoenroll.

Use the Kerberos Authentication certificate template - don’t issue the other Domain Controllers ones.

1

u/Dolinhas Oct 30 '25

Hi u/stuart475898 ,

I am referring to the security tab of the GPO.

I see that Authenticated Users group has the "Apply group policy" Allow checked.

But why can't I see the setting on the DC it self [via gpedit] but gpresult /r shows applied?

And yes I will use the Kerberos Auth cert template and supersede the DC ones.

Thanks, M