Manually create certificates for your users
First you need to enable the Enrollment Agent Template from your CA.
After you have enabled the Template you need to create an Enrollment Agent Certificate for the admin who will create all the User Certificates. The admin needs to be logged on with his credentials, open a MMC console and request a new certificate:
Select the type of certificate to issue and click “Enroll” to create the certificate.
After this the admin will be able to create User Certificates on behalf of other users. This is done by selecting to create an “User” certificate instead of an “Enrollment Agent” certificate.
You can permit only certain Enrollment Agents to create User Certificate from the Properties of the CA: