You created a computer certificate template for mutual TLS on application servers. Clients are domain-joined Windows 10/11 devices, but they are not autoenrolling. You need to enable automatic enrollment and issuance without manual steps. What should you configure? Choose two actions.

For automatic enrollment to function, two key components must be configured. First, the Group Policy Object (GPO) applied to the client computers must enable 'Certificate Services Client - Auto-Enrollment' and specifically configure the options to 'Enroll certificates automatically' and 'Renew expired certificates, update pending certificates, and remove revoked certificates'. This instructs the clients to attempt autoenrollment. Second, the certificate template itself needs to be configured with the correct permissions. The 'Domain Computers' group (or a more specific security group containing the target computers) must have 'Read', 'Enroll', and 'Autoenroll' permissions. Additionally, the template must be published on the enterprise Certificate Authority (CA) so that clients can discover and request it. Converting the enterprise CA to a standalone root CA is incorrect because standalone CAs do not support autoenrollment. Running 'gpupdate /force' on the CA server is incorrect; GPOs apply to clients, not the CA in this context. Running 'certutil -pulse' on clients is incorrect as it only refreshes the autoenrollment timer and won't work if the underlying GPO and template permissions aren't properly configured.