Fix CERTSRV_E_UNKNOWN_CERT_TYPE (0x80094813) on CA

You're on a Windows Server 2016 or 2019 CA, you've just hit certutil -CRL or restarted Certificate Services, and the Event Log spits out CERTSRV_E_UNKNOWN_CERT_TYPE (0x80094813) along with "One or more certificate templates to be enabled on this CA could not be found." The CA service stalls, the certificate templates snap-in shows a blank list, and issued certs fail. This isn't a random glitch. It shows up after you've promoted a new CA, restored an old one from backup, or changed the template list while the service was down.

What's actually happening

Certificate templates live in Active Directory, not on the CA itself. When the CA starts, it reads the certificateTemplates attribute of its pKIEnrollmentService object to see which templates it's supposed to publish. It then tries to match each name against the actual template objects in the CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=... container. If any name in that list doesn't exist in AD — because the template was deleted, renamed, or never replicated — the CA can't resolve it and throws 0x80094813. The real problem isn't the CA service. It's a mismatch between what the CA thinks it should publish and what AD actually contains.

Fix it step by step

Open an elevated command prompt on the CA server. Run certutil -CATemplates. This lists every template the CA is configured to publish, plus a status column. Any entry marked "Not Found" or "Unknown" is your culprit. Write down those names exactly.
Check AD for those template names. Use certutil -Template or open certtmpl.msc on a domain controller. If a template listed by the CA doesn't show in the Certificate Templates console, it's missing from AD. That's your root cause.
Remove the stale entry from the CA's published list. In the Certification Authority snap-in (certsrv.msc), right-click Certificate Templates, choose New > Certificate Template to Issue. If the missing template doesn't appear there, you'll need to remove it from the CA's AD object directly. Run:
```
certutil -SetCATemplates -<TemplateName>
```
Actually, the safer route is to edit the certificateTemplates attribute of the CA's pKIEnrollmentService object using adsiedit.msc. Find the CA object under CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,DC=.... Remove the bad template name from the multi-valued attribute.
Force a policy refresh. Back on the CA, run certutil -pulse or restart the Certificate Services service (net stop certsvc && net start certsvc). The error should clear from the Event Log.
If the template should exist, restore it. If you deleted a template by mistake, you can recreate it from a backup of the Certificate Templates container, or use certutil -ImportTemplate if you exported it earlier. After restoring, republish it to the CA via certsrv.msc.

What to check if it still fails

If 0x80094813 keeps coming back, verify AD replication first. A template might exist on one DC but not the one the CA is talking to. Run repadmin /showrepl and confirm the Configuration partition is healthy. Also check permissions: the CA's computer account needs Read access on each template object. If someone tightened ACLs on the Certificate Templates container, the CA can't see them. Last, make sure you're not dealing with a lingering object from a failed CA decommission — those can leave orphaned entries in AD that confuse the new CA. Clean them with certutil -DeleteTemplate only if you're absolutely sure the template isn't in use.