COMMAND EVERYTHING.

Set-CertificateAutoEnrollmentPolicy

Sets local certificate auto-enrollment policy.

Networking / Security · Risk: High · Documentation Verified

Last verified: 2026-10-26

Microsoft pki reference: Sets local certificate auto-enrollment policy. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.

Set-CertificateAutoEnrollmentPolicy [-StoreName <String[]>] -PolicyState <PolicySetting>
 [-ExpirationPercentage <Int32>] [-EnableTemplateCheck] [-EnableMyStoreManagement]
 [-EnableBalloonNotifications] -context <Context> [-WhatIf] [-Confirm] [<CommonParameters>]

Copied 0 times

Required permissions

Use an account with the target resource permissions documented for Set-CertificateAutoEnrollmentPolicy. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.

Supported environments

Windows / pki · Windows Server 2025 documentation; feature/module prerequisites apply

Parameters

-Confirm: Prompts you for confirmation before running the cmdlet.
-Context (required): Specifies whether to set certificate auto-enrollment policy for the user or computer context.
-EnableAll (required): Enables all of the auto-enrollment policy settings and sets the value for the expiration percentage to 10 percent. If this parameter is enabled, then only the Context parameter is required and all other parameters are optional.
-EnableBalloonNotifications: Enables the Expiration balloon notifications option for the certificate auto-enrollment policy.
-EnableMyStoreManagement: Enables the Renew expired certificates, update pending certificates, and remove revoked certificates option for the certificate auto-enrollment policy.
-EnableTemplateCheck: Verifies that existing certificates are based on the most recent version of a certificate template and updates them if they are not.
-ExpirationPercentage: Sets the percentage of the certificate lifetime at which close-to-expiration events are logged and auto-enrollment notifications start to appear.
-PolicyState (required): Specifies the state of the certificate auto-enrollment policy configuration.
-StoreName: Specifies additional comma separated certificate stores to monitor for certificates that have expired or are expiring. The MY store is always monitored.
-WhatIf: Shows what would happen if the cmdlet runs. The cmdlet is not run.

Prerequisites

Windows with the pki module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.

Security considerations

This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.

Examples

EXAMPLE 1

Set-CertificateAutoEnrollmentPolicy @params

This example enables local user certificate auto-enrollment policy with the Renew expired certificates, update pending certificates, and remove revoked certificates and Update certificates that use certificates templates options enabled. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.

Sources

https://github.com/MicrosoftDocs/windows-powershell-docs/blob/b7645dd8c687139b28e845119da30ec670526507/docset/winserver2025-ps/pki/Set-CertificateAutoEnrollmentPolicy.md

https://learn.microsoft.com/powershell/module/pki/set-certificateautoenrollmentpolicy?view=windowsserver2025-ps

Personal collections

Explain or customize this command with AI

Related commands

Get-NetIPInterface

Add-MpPreference

Get-MpPerformanceReport

Add-DhcpServerInDC