You have Active Directory Certificate Services (AD CS) deployed.
You create a custom certificate template.
You need to ensure that all of the users in the domain automatically enroll for a certificate based onthe custom
certificate template.
Which two actions should you perform? (Each correctanswer presents part of the solution. Choose two.)

A.
In a Group Policy object (GPO), configure the autoenrollment settings.

B.
In a Group Policy object (GPO), configure the Automatic Certificate Request Settings.

C.
On the certificate template, assign the Read and Autoenroll permission to the Authenticated Users group.

D.
On the certificate template, assign the Read, Enroll, and Autoenroll permission to the Domain Users group.

Explanation:
Reference:
http://technet.microsoft.com/en-us/library/dd379539.aspx
To automatically enroll client computers for certificates in a domain environment, you must:
Configure an autoenrollment policy for the domain.
(…)
In Configuration Model, select Enabled to enable autoenrollment.
Configure certificate templates for autoenrollment.
(…)
In the Permissions for Authenticated Users list, select Read, Enroll, and Autoenrollin the Allow column, and
then click OK and Close to finish
Configure an enterprise CA.