Your company has a single Active Directory directory service domain. You have multiple member servers that run Windows Server 2003 SP2 and are configured as Enterprise certification authorities (CAs).

Your CAs accept auto-enrollment requests but do not issue new certificates. You ascertain that multiple Active Directory security groups are missing from the configuration. You need to create the security groups that are necessary to ensure that all users can auto-enroll.

What are two possible ways to achieve this goal? (Each correct answer presents a complete solution. Choose two.)

A.
Create a CERTSVC_DCOM_ACCESS security group that contains the Everyone security group.

B.
Create a CERTSVC_DCOM_ACCESS security group that contains all the Enterprise CA computer accounts.

C.
Create a Certificate Publishers security group as a domain local group that contains all the Enterprise CA computer accounts.

D.
Create a Certificate Publishers security group as a universal group that contains all the user accounts that have Registration Authority privileges.