title: Do auto-enrolled certificates follow you around?
body: <p>If you auto-enroll an account for an X.509 certificate in a Windows PKI environment, do you get the same certificate (and, by extension, private key) on every computer in the domain that you log into, or does a different certificate get issued for each computer you log into?</p>
  
  <p>I would expect there would be a single certificate that would appear in the CurrentUser certificate store on each computer you logged into.  But this is a matter of dispute and I don't have an environment where I can test it.</p>
  
  <p>Are there any subtleties of configuring the certificate template that affect this?  Does not using roaming profiles affect this?</p>
  
  <p>If it matters, I am most interested in how this works for service accounts, but I expect it would be the same as for interactive user accounts.  </p>
  
  <p>Our PKI is currently Server 2003.  It should be migrated to Server 2008 within a year.</p>