Windows 7 Fix Autoenrollment Machine Certificate

Jump to: navigation, search


This all needs doing with an Admin/System account, running elevated.

SCCM Client wont install, hmmm, c:\Windows\ccmsetup\ccmsetup.log says

<![LOG[Certificate issued to '' has expired.]LOG]!>

should say

<![LOG[The certificate issued to '' has 'Client Authentication' capability.]LOG]!>

Looks like a certificate problem!

c:\>certutil -store My

If this shows the certificate is expired, then you have a problem.

i.e 'NotAfter:' should be a date in the future (you will probably see other certificates with !Archived that have expired already, this is ok.)

Try forcing an Autoenrollment event. This should return "CertUtil: -pulse command completed successfully." on a working system.

c:\>certutil -pulse

CertUtil: -pulse command FAILED: 0x80070002 (WIN32: 2) 
CertUtil: The system cannot find the file specified.

If this fails check out the task scheduler is at least running, this should show status as RUNNING

c:\>sc query Schedule

See if it is working correctly with schtasks - if you see N/A in the Status column it is broken, it SHOULD say 'Ready' , below is an excert


Folder: \Microsoft\Windows\CertificateServicesClient
TaskName                                 Next Run Time          Status
======================================== ====================== ===============
SystemTask                               N/A                    N/A
UserTask                                 N/A                    N/A

Yep, it is broken!

You will also notice you cant run the task nor delete it. (i.e. these will fail, schtasks /run /TN "\Microsoft\Windows\CertificateServicesClient\SystemTask" or schtasks /delete /TN "\Microsoft\Windows\CertificateServicesClient\SystemTask")


In Windows 7 you cannot just copy and paste the tasks you must import them. (They have SID's)

Source machine

First you need to gather all the scheduled tasks from a good machine. (This script was created by joseph.garfield and has a few small alterations to it.)

@echo off
setlocal EnableDelayedExpansion

if %1. == export. call :export
if %1. == import. call :import
exit /b 0
md tasks 2>nul
schtasks /query /fo csv | findstr /V /c:"TaskName" > tnlist.txt
for /F "delims=," %%T in (tnlist.txt) do (
  set tn=%%T
  set fn=!tn:\=#!

  echo  Exporting !tn! !fn!
  schtasks /query /xml /TN !tn! > tasks\!fn!.xml

exit /b 0
for %%f in (tasks\*.xml) do (
	call :importfile "%%f"
exit /b 0
  	set filename=%1
	rem replace out the # symbol and .xml to derived the task name
	set taskname=%filename:#=\%
	set taskname=%taskname:tasks\=%
	set taskname=%taskname:.xml=%

	echo  Importing %taskname% from %filename%
	schtasks /create /tn %taskname% /xml %filename%

So assuming its saved somewhere on the source machine as tasks.bat

cd %temp%
tasks.bat export

Copy tasks.bat + tnlist.txt + \Tasks (folder created) to the broken machine (in its temp folder ideally), keeping the same structure, i.e. %temp%\tasks.bat %temp%\tnlist.txt and %temp%\Tasks\

On broken machine

reg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\AutoEnrollment\AEDirectoryCache" /f
rmdir /s /q "c:\Windows\System32\Tasks\Microsoft\Windows"
cd %temp%
tasks.bat import

You should see the tasks import ok and c:\Windows\System32\Tasks\Microsoft\Windows and sub folders get re-created. e.g.

 Directory of c:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient

07/08/2013  16:10    <DIR>          .
07/08/2013  16:10    <DIR>          ..
07/08/2013  16:10             4,468 SystemTask
07/08/2013  16:10             4,088 UserTask
07/08/2013  16:10             3,220 UserTask-Roam
               3 File(s)         11,776 bytes
               2 Dir(s)  270,992,662,528 bytes free

Running the task should then work

C:\>schtasks /run /TN "\Microsoft\Windows\CertificateServicesClient\SystemTask"
SUCCESS: Attempted to run the scheduled task "\Microsoft\Windows\CertificateServicesClient\SystemTask".

Pulse should then work

C:\>certutil -pulse
CertUtil: -pulse command completed successfully.

You should then get a new valid certificate

C:\>certutil -store My
================ Certificate 0 ================
Serial Number: 62f43f870000000033cf
Issuer: CN=xxxxxxxxxxx CA, DC=uol, DC=le, DC=ac, DC=uk
 NotBefore: 16/04/2013 15:39
 NotAfter: 16/04/2014 15:39
Subject: EMPTY (DNS
Non-root Certificate


The original script

The same/similar problem on Vista

  • This last one suggested to delete the SUBKEYS from HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Schedule, it may be a better way to fix the scheduled tasks without needing import/export?


blog comments powered by Disqus