Your network contains an enterprise certification authority (CA)that runs Windows Server 2008 R2
Enterprise.
You need to ensure that users can enroll for certificates that use the IPSEC (Offline request) certificate
template.
Which snap-inshould you use?

A.
Enterprise PKI

B.
TPM Management

C.
Certificates

D.
Active Directory Users and Computers

E.
Authorization Manager

F.
Certification Authority

G.
Group Policy Management

H.
Security Templates

I.
Certificate Templates

Explanation:
Reference:
http://social.technet.microsoft.com/Forums/en/winserversecurity/thread/962be5d1-d824-4dd8-a501-3c3a9d600083
(…) the user should have proper permission on Certificate Templates. Please follow the steps below for
troubleshooting:
1. Open MMC, add Certificate Templates snap-in.
2. Double-click IPSec (Offline Request), switch to Security tab, give the user Read and Enroll rights.
3. Close and restart IE on clients computer to test.