Restart the SMS Agent Host service (ccmexec).

If expediency is required the following steps can be performed: Once the certificate is installed, the client should automatically register the new management point eventually (less than 24 hours).

The client's certificate status is visible in MECM by adding the Client Certificate column when viewing devices.

The client should have a certificate issued by SubCA using the IS MECM Client Certificate template.

Confirm Auto-Enrollment is working for your clients by checking personal store on client.

(optional) If you would like to expedite the application of this new policy run the following on your client: gpupdate /force.

Link to the OU in Active Directory (AD) where you want clients to receive this certificate.

Update certificates that use certificate templates.

Select Renew expired Certificates, update pending certificates, and remove revoked certificates.

Computers > Policies > Windows Settings > Security Settings > Public Key Policies > Certificate Services Client - Auto-Enrollment.

It is advised to use the Distribution Point Group instead which includes both the internal and external Distribution Points. It is important to be aware that any deployments made to a single distribution point will not reach both intranet and internet-based clients. In addition to the existing MECM infrastructure, there is an additional server that hosts the Management Point, Software Update Point, and Distribution Point roles for Internet-based clients. In order to complete this procedure you will need access to create, modify and link group policy in your OU as well as administrative access to Microsoft Endpoint Configuration Manager (MECM). This article is intended for IT Administrators who manage MECM. Enable MECM management for computers that connect to UO remotely.

Mecm microsoft