For WSTEP enrollment, an enrollment client is a Windows user or a machine that requires a certificate. Enrollment clients are either in a Windows Domain or connected to a Windows Domain. With cross-forest trust (see Cross-forest trust), enrollment clients from one forest can request a certificate from a Domain Controller in another forest.