User Is Prompted to Download ActiveX Control When Requesting Certificate

When a non-administrator user tries to request a certificate from the certification authority (CA) on a Windows Server 2003 computer, the user is prompted to download and install an ActiveX control. The user may not be able to install the ActiveX control if they are not logged onto the computer as an Administrator.

This issue may occur if the Windows Server 2003 computer uses a more recent version of the Xenroll.dll file than the version used by the user's computer.

To resolve this issue, edit the Certdat.inc file on the server. To do this, follow these steps:

1. On the server, use Notepad to open the Certdat.inc file. By default, the file is installed in the following folder:
   %windir%\System32\Certsrv
2. Locate the following line:
   sXEnrollVersion="5,131,3686,0"
3. Edit the line so that it appears as follows:
   sXEnrollVersion="5,131,3659,0"
4. Save, and then close the file.

Microsoft has confirmed that this is a bug in the Microsoft products that are listed at the beginning of this article.