Users Granted Permission to Manage the Certificate Authority Are Unable to Access It Remotely

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To resolve this issue, give the user permission to manage the CA. To grant this access to a non-administrative account, follow these steps:

1. Open the CA snap-in.
2. Right-click Certificate Authority Root and click Properties.
3. Click the Security tab.
4. Add the user who needs access and grant that user the required permissions.

The CA snap-in must be installed on the remote machine for the user to have remote access to the CA.

To give a non-administrative account permission to remotely manage a CA, follow these steps:

1. Open the CA, click Run, and then type Regedt32.
2. Navigate to the following registry key:
   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths
3. Open the Machine key and at the bottom of the key add the following value:
   SYSTEM\CurrentControlSet\Services\CertSvc\Configuration
   
4. Click Save.

The remote user now has remote access to the CA.