Your forest is Windows Server 2016. Autoenrollment is already enabled via GPO. You must issue user encryption certificates using CNG keys that support key archival for recovery. What two configurations are required?

To issue user encryption certificates with CNG keys that support key archival, you need to configure both the certificate template and the Certificate Authority (CA). Duplicating the User template as a v3 (Windows Server 2008 or later) template is crucial because v3 templates support CNG (Cryptography Next Generation) keys, which are required by the prompt. Enabling 'Archive subject's encryption private key' on this template ensures the private key is escrowed. Publishing the template makes it available for autoenrollment. The second required configuration involves the CA. For key archival to function, the CA needs a Key Recovery Agent (KRA) certificate. Issuing a KRA certificate to designated recovery officers and adding these certificates to the CA's Key Archival configuration allows the CA to encrypt and store the archived private keys, making them recoverable by authorized personnel. The incorrect options are: Creating a v2 User template using legacy CSP keys will not meet the requirement for CNG keys. Disabling key archival and relying on DPAPI backups is not a solution for certificate key archival and recovery. Disabling user certificate autoenrollment would prevent the certificates from being automatically issued, contradicting the existing autoenrollment setup.