Powershell – How to add a service account (sp_c2wts) to local security policy using powershell

The best recommendation I have right now is that you check out using WMI for this (see root\RSOP\computer namespace). Unfortunately all the times that this topic has come up, I never seem to have been able to find a solution to it. There's an old thread on MSDN from 2007 that was never answered either.

You can use SAPIEN WMI Explorer (link below), a free community tool, to browse the WMI namespace and see if what you're looking for is there. I don't believe it is, but you might find some other useful things there.

http://www.primaltools.com/downloads/communitytools/

I presume your certificate requests are made using a template. If that's the case then use the Public Key Policies/Certificate Services Client - Auto-Enrollment Settings GPO to enforce auto enrollment. You'll also want to ensure the template ACL has Enroll and AutoEnroll marked for either domain computers or domain users (or whatever acl object, depending on the intended audience) There's a user config and computer config policy to leverage depending on whether or not it's a machine cert or user cert you're trying to push. Enrollment begins as soon as when the policy is pushed (usually about 15 minutes) after the GPO is linked and enforced.