Windows Server 2016 – AD CS certificate template error – The requested certificate template is not supported – Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Issuing CAs on Windows Server 2016 return ‘The requested certificate template is not supported by this CA’ when clients enroll, breaking auto-enrollment for web servers and devices.

Environment & Reproduction

Common after template duplication or compatibility level changes.

certutil -CATemplates
certlm.msc
Get-WinEvent -LogName 'Microsoft-Windows-CertificateServicesClient-Lifecycle-System/Operational' -MaxEvents 20

Root Cause Analysis

The CA may not have the template assigned, or schema/compatibility levels mismatch what the client requests.

Quick Triage

Inspect CA template list.

certutil -CATemplates
certutil -dump
Get-CATemplate

Step-by-Step Diagnosis

Verify enrolment permissions and compatibility settings.

Get-CATemplate | Where-Object {$_.Name -eq 'WebServerV2'}
certutil -view -restrict 'Disposition=20' -out 'RequestID,RequesterName,CertificateTemplate'

Solution – Primary Fix

Add the template to the CA and refresh.

Add-CATemplate -Name 'WebServerV2' -Force
certutil -setreg catemplates +WebServerV2
Restart-Service CertSvc

Solution – Alternative Approaches

Lower template compatibility for legacy clients if required.

# In Certificate Templates Console: set Compatibility to Windows Server 2012 R2 for CA and Recipient
Get-CATemplate

Verification & Acceptance Criteria

Clients receive certificates and the CA log shows successful issuance.

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-CertificationAuthority']]]" -MaxEvents 10
certutil -view -restrict 'Disposition=20'

Rollback Plan

Remove the template from the CA if rollback is needed.

Remove-CATemplate -Name 'WebServerV2' -Force
Restart-Service CertSvc

Prevention & Hardening

Maintain a template inventory, document compatibility levels, and pilot template changes in a lab CA first.

Get-CATemplate | Export-Csv C:Tempca-templates.csv -NoTypeInformation

Related Errors & Cross-Refs

Linked with SChannel TLS failures, IIS auth issues, and LAPS modern stack certificate use.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Learn: AD CS certificate templates and compatibility levels.