Restricted Enrollment Agents

Requesting certificates via Enroll on Behalf of (EOBO) fails with the error message "The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester."

A certificate is requested for a user from a certification authority via the certificate management console (certmgr.msc).
One uses here the Enroll on Behalf of (EOBO) Mechanism.
The certificate request fails with the following error message:

The operation is denied. It can only be performed by a certificate manager that is allowed to manage certificates for the current requester.

Event Source:	Microsoft-Windows-CertificationAuthority
Event ID:	21 (0x15)
Event log:	Application
Event type:	Error
Symbolic Name:	MSG_E_PROCESS_REQUEST_FAILED
Event text (English):	Active Directory Certificate Services could not process request %1 due to an error: %2. The request was for %3.
Event text (German):	The request %1 could not be executed due to an error: %2. The request was for %3.

English