edit the existing default domain policy. enable auto-enrollment for computer certificates and enable renew expired certificates. update certificates that use templates. enable auto-enrollment for user certificates and enable renew expired certificates. update certificates that use templates. certificate lifetime is 15% display notifications for expiring certificates in my store.