A.Remove the Request Certificates permission from the Domain Users group.
B.Remove the Request Certificated permission from the Authenticated Users group.
C.Assign the Allow - Manage CA permission toonly  the Security Manager user Account.
D.Assign the Allow - Issue and Manage Certificates permission to only the Security Manger user account

A.Run auditpol.exe.
B.Modify the auditing entry for OUI.
C.Modify the auditing entry for the domain.
D.Create a new Group PolicyObject （GPO）. Enable Audit account management policy setting. Link the GPO to OUI.