Policy
Support device authentication using certificate
Microsoft Windows
Policy overview
Key metadata and intent for this policy.
Supported OS tags: Windows10, Windows10RT, Windows11, WindowsServer2016
Support for device authentication using certificate will require connectivity to a DC in the device account domain which supports certificate authentication for computer accounts. This policy setting allows you to set support for Kerberos to attempt authentication using the certificate for the device to the domain. If you enable this policy setting, the devices credentials will be selected based on the following options: Automatic: Device will attempt to authenticate using its certificate. If the DC does not support computer account authentication using certificates then authentication with password will be attempted. Force: Device will always authenticate using its certificate. If a DC cannot be found which support computer account authentication using certificates then authentication will fail. If you disable this policy setting, certificates will never be used. If you do not configure this policy setting, Automatic will be used.
Registry values
How enabled and disabled states update the registry.
| Scope | Registry location | Type | Enabled value | Disabled value | Copy |
|---|---|---|---|---|---|
| Computer | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters Value name DevicePKInitEnabled | REG_DWORD | HKLM 1 | HKLM 0 |
Policy elements
Inputs and configuration options exposed by this policy.
| Scope | Element | Type | Registry mapping | Constraints & behavior | Copy |
|---|---|---|---|---|---|
| Computer | Device authentication behavior using certificate: ID DevicePKInitBehavior | enum | Path Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters Value name DevicePKInitBehavior Type REG_DWORD | Options: Automatic (0), Force (1) |