How to create 3rd Party CA NTAuth trust without autoenroll

as sets certificate authentication third party web applications, 1 of hardest things in windows troubleshoot certificate authentication failures.  during process, unless iis involved in particular step (checking crl / validating account), getting logging near impossible.  

i have tried looking security audit event logs information security audit logs not have detailed error information indexed anywhere. site listed below provides great example of logon failure status , sub status codes codes normal authentication methods.  i have yet see guide on troubleshooting logon failure events coming lsass.exe , schannel.  

windows security log event id 4625 - account failed log on

my sub-status code, 0x80090325, not included in guide.

where can list of comprehensive failure status codes future troubleshooting?  how can more advanced logs active directory mapped client certificate authentication iis 7/8?

for future reference capi event log in:

event viewer (local) > windows logs > application , service logs > microsoft > windows > capi2

i found issue.  apparently the ca root not trusted ntauth store, extremely weird since used enterprise pki snap in add public key of root ca ntauth store.  below capi error:

<result value="800b0112">a certification chain processed correctly, 1 of ca certificates not trusted policy provider.</result> 

the odd thing the "certutil -dspublish -f filename ntauthca" command did not work claiming cert existed, when instead used  "certutil -enterprise -addstore ntauth ca_certfilename.cer" a certificate got added , certutil replied public key added (i confirmed checking registry hkey_local_machine\software\microsoft\enterprisecertificates\ntauth\certificates).  i find odd.

Windows Server  >  Security