If you still have client computers with Windows XP, you might encounter the following error while enrolling certificate from Active Directory Certification Services (ADCS), which working under Windows Server 2012 R2:
EventID 13
Source AutoEnrollment
0x80094011
The permissions on this certification authority do not allow the current user to enroll for certificates (this error you will find in Application Event Log on client computer).