CERTSRV_E_RESTRICTEDOFFICER (0X80094009) fix

Cause #1: The user isn't in the Certificate Manager or Restricted Officer AD group

This is the most common trigger for error 0X80094009. It happens when someone submits a certificate request — usually through the Certificates MMC snap-in or a web enrollment page — and the CA is configured to only issue certificates to members of specific security groups. The error message "The operation is denied" is the CA's way of saying, "I can't issue that cert because Active Directory says you don't have permission."

You'll see this often in organizations that use the Certificate Manager restriction feature. That feature is enabled on the CA's properties under the Security tab, where the CA is set to only allow enrollment requests from users in the Certificate Manager or Restricted Officer groups. If your user isn't in one of those groups, the CA rejects the request with 0X80094009.

How to fix it

1. Open Active Directory Users and Computers on a domain controller or a management workstation with RSAT installed. If you're on a domain controller, it's under Administrative Tools. On a Windows 10/11 machine, install the RSAT tools for AD DS if you haven't already.
2. Find the user account that's getting the error. Right-click it, select Properties, then the Member Of tab.
3. Click Add, then type Certificate Manager or Restricted Officer in the object picker. The exact group name depends on what your CA admins set up. In many environments, it's a group named Certificate Managers or CA Restricted Officers. If you're not sure which group, ask the CA admin.
4. Click OK on all windows.
5. The group membership change takes effect when the user logs off and back on. A simple reboot or logoff/logon cycle is required. Just refreshing the MMC won't cut it.
6. After the user logs back in, retry the certificate enrollment. The error should be gone. If it's not, move to the next cause.

Expected outcome after the fix: The user will be able to submit the certificate request and get it issued without the 0X80094009 error.

Cause #2: The certificate template has enrollment permissions that conflict with the user's group membership

Less common, but I've seen this trip up sysadmins who think the user is in the right group but the template itself has stricter permissions. Every certificate template has its own ACL (access control list) that controls who can enroll, who can read, and who can auto-enroll. If the template's Enroll permission doesn't include the user or the user's groups, the CA will reject the request with 0X80094009, even if the user is in the Certificate Manager group.

This is especially common when a template was copied from a built-in template (like User or Computer) and the permissions were tightened. The user might have Read access but not Enroll.

How to fix it

1. On the CA server, open the Certification Authority snap-in. Right-click Certificate Templates and select Manage.
2. Find the template the user is trying to enroll in. Right-click it and select Properties. Go to the Security tab.
3. Look at the permissions list. The user or the group they're a member of must have Enroll permission checked under the Allow column. If you see only Read and Enroll is missing, that's your problem.
4. Click Add, type the user's name or the group (like Domain Users), and grant Enroll permission. Be careful not to open it up to everyone unless that's the goal. Most orgs grant enroll to Domain Users or a specific security group.
5. Click OK. Now you need to reissue the template to the CA. Back in the Certification Authority snap-in, right-click Certificate Templates, select New > Certificate Template to Issue, then pick the template you just changed. This step applies the new permissions.
6. Have the user retry enrollment. It should work now.

Expected outcome after the fix: The user can enroll in the template. The error won't appear.

Cause #3: The CA security settings are overly restrictive

Sometimes the issue isn't the user or the template — it's the CA's own security tab. The CA itself has a security ACL that controls who can submit requests. If the Issue and Manage Certificates permission is set to Deny for the user's group, or if the group isn't listed with Request Certificates allowed, then any enrollment from a member of that group gets blocked.

This is rare because most CAs leave the Request Certificates permission wide open for Authenticated Users. But if a security-conscious admin locked it down, you'll hit 0X80094009.

How to fix it

1. Open the Certification Authority snap-in on the CA server.
2. Right-click the CA name at the top of the tree, select Properties, then the Security tab.
3. Look for the user or group in the list. If they're not there, click Add and add them (or their group).
4. Make sure the Request Certificates permission is checked under Allow. If it's blank or denied, check the allow box.
5. Click OK. No restart needed — changes take effect immediately.
6. Test the enrollment again.

Expected outcome after the fix: The CA now accepts requests from the user. The error is gone.

Quick-reference summary table