I set up a small testlab in vbox consisting of four servers. Two domain controllers dc01, dc02, one offline root ca and one online enterprise sub ca, ca01.

All servers are based on Windows Server 2008 R2 Standard.

Everything works as excpected except one thing. If I issue a certificate template with read, enroll and autoenroll rights to the security group "domain controllers" it does not let dc01 or dc02 to enumerate or enroll for the certificate.

I've restarted both domain controllers several times to update their credential tokens with the correct group memberhips.

So I added dc01 to the "domain computers" group and gave that group read, enroll and autoenroll rights in the template, bam, the certificate was issued.

So my question is, why isn't the domain controllers group memberhips reflected in the domain controllers (dc01 and dc02) credentials?

Can I view the computers credentials somehow and how should I go about trying to resolve the issue?