Configuring Autoenrollment to issue certificates to all domain-joined systems

Many new technologies requiring certificates to be used for authentication require those certificates to be distributed on a large scale. For example, if we want to use the Computer certificate for DirectAccess authentication, we need to issue a certificate to every DirectAccess client computer. This can be done for thousands of laptops in your network. If we want to start encrypting traffic inside the network with IPsec and require certificates to be distributed for that purpose, we would potentially need to issue some kind of machine certificate to every computer inside our network. While we could certainly issue each by hand using either the MMC console or the CA web interface, that doesn't sound like very much fun.

Enter Autoenrollment. We can turn this feature on, which is sort of like flipping a switch in Active Directory, and in doing so, we can tell AD to issue certificates automatically to...