Automatic certificate enrollment for local system failed to enroll for one Domain Controller certificate (0x80070005). Access is denied.

http://support.microsoft.com/kb/903220

Event Type: Error
Event Source: AutoEnrollment
Event Category: None
Event ID: 13
Date: date
Time: time
User: N/A
Computer: computer_name
Description: Automatic certificate enrollment for local system failed to enroll for one Workstation Authentication certificate (0x80070005). Access is denied. For more information, see Help and Support Center at http://support.microsoft.com.

Note If these errors occur on a domain controller, then add the Domain Controllers group to the CERTSVC_DCOM_ACCESS group. Domain controllers are not members of the Domain Computers global group and will not have sufficient DCOM permissions by default.

If you change the group membership to include the Domain Controllers group, you must restart the domain controller to reflect the change.

1. Start the Exchange Management Console.

2. In the console tree, expand Recipient Configuration, and then click Mail Contact.

3. In the action pane, click New Mail Contact. The New Mail Contact wizard appears.

4. On the Introduction page, click Existing contact, and then click Browse.

5. In Select Contact, select the contact that you want to mail-enable, click OK, and then click Next.

6. On the Contact Information page, complete the following fields:

   • Organizational unit   By default, the New Mail Contact Wizard displays the Users container in Active Directory. To modify this field, click Browse, and then select the organizational unit (OU) that you want.
     
   • First name   Type the first name of the contact. This field is optional.
     
   • Initials   Type the initials of the contact. This field is optional.
     
   • Last name   Type the last name of the contact. This field is optional.
     
   • Name   By default, the name is the first name, initials, and last name of the contact. You can modify this field.
     
   • Alias   By default, the alias is the first name, initials, and last name of the contact, separated by underscore characters (_). You can modify this field.
     
   • External e-mail address   To specify the external e-mail address, perform one of the following tasks:
     To specify a Simple Mail Transfer Protocol (SMTP) e-mail address, click Edit, and then in E-mail address, type the SMTP e-mail address.
     To specify a custom e-mail address, click the arrow next to Edit, click Custom Address, and then in E-mail address, type the e-mail address and the e-mail type. For example, you can specify an X.400, GroupWise or Lotus Notes address.
     

7. Click Next.

8. On the New Mail Contact page, review the configuration summary, which contains information about the options that you selected for the mail contact. To make changes, click Back. To create the mail-enabled contact, click New.

9. On the Completion page, the summary states whether the contact was successfully mail-enabled. The summary also displays the Exchange Management Shell command that was used to mail-enable the contact.

10. Click Finish to complete the task