I've been racking my head on and off for over a month on trying to stand up a PKI in my lab environment.
I used this guide to setup my PKI and after a few modifications it worked perfect!
http://www.derekseaman.com/2014/01/windows-server-2012-r2-two-tier-pki-ca-pt-1.html
When I go to PKI view everything is OK. I have my Offline Root installed properly as it has the CDP and AIA with a OK status my my sub ca has OK for AIA and CDP.
Now the problem happens on the actual CA as it logs event ID 44 in Application everytime Certificate Services Starts.
Specifically the entire code is
The "Windows default" Policy Module "Initialize" method returned an error. Cannot find object or property. The returned status code is 0x80092004 (-2146885628). The Active Directory Certificate Services Policy contains no valid
Certificate Templates.
After the event is logged I get event ID 26 stating that it started and is running on DC=domain controler FQDN. I also get a DCOM object error in system
The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{D99E6E73-FC88-11D0-B498-00A0C90312F3}
and APPID
{D99E6E74-FC88-11D0-B498-00A0C90312F3}
to the user DOMAIN\Username SID (S-1-5-21-2276686680-1213147667-977454713-1105) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services
administrative tool.
I tried adding my account to the CertSrv object though it did not seem to fix anything and I am not familiar with DCOM object access.
Ive followed the event id 44 guide from https://technet.microsoft.com/en-us/library/cc774512%28v=ws.10%29.aspx?f=255&MSPPError=-2147217396 and I used the MSG_NO_CERT_TYPES and followed the guide for verifying permissions and everything checks out just
fine.
I should also mentioned I have tried 2 different Root CAs and 4 sub CAs thinking maybe they installed wrong. I previously had a very broken PKI installed and that was fully removed and replaced by my second iteration which worked fine except I could never
get PKI view happy and that's when I tried iteration and 3 and 4. I used this guide to decommission the previous CA environments.
Overall I really would like to get a PKI stood back up in my lab so that I can issue Web Certificates and learn more about it.
I should also not I have deleted the existing Certificate Templates and recreated them several times and when I load Certificate Templates from the sub CA it sees them all just fine and I can edit them and create new ones.
~Wesley K.