Allow or deny permissions for an Active Directory group to enroll or autoenroll certificates for a template.