SCEP certificates stored under service account and not under the user's account - preventing successful ActiveSync CBA

Hi,

we use SCEP and it works so far without any problems. Now we'd like to enable CBA on our Active Sync accounts, the certificates are issued and distributed - BUT: MS SCEP publishes them in the Active Directory only for the service account and not in the context of the correct user. So CBA doesn't work.

Any ideas how we can automate this?

BR
Chris