Certificate templates

trackit

I am wondering, if you use autoenrollment then how can you assign specific certificate template for specific user(s). In GPOs user portion there is very little options you can select. Basically you can only either allow autoenrollment or not.

Is the only way to somehow assign specific templates through DACL permissions? if so, then what happens if i have more than 1 template that have more or less the same purpose (lets say both have EFS in it) and more or less same DACL (lets say domain users can read, enroll and autoenroll both templates)? based on which template will users get their certificate?

i havent found any good material that explains this and i am little confused... so if you know how it works or have some links to recommended whitepapers or something then i would appreciate that.