I am currently setting up PKI in my Endpoint Configuration Manager environment. Every article I read mentions checking Read, Enroll and AutoEnroll for Domain Computers uder the security tab of the client certificate. None how ever say anything about Domain Controllers. We manage our Domain Controllers just like we do any other client. Should I add Domain Controllers to the template or do something else?