The templates include, among other things, a list of Key Usage (KU) and Extended Key Usage (EKU) fields that you would like in the issued certificate. Outside of very specific Microsoft services, the template field itself is not checked when evaluating a certificate (it is a Microsoft-only field, not a standard), but basically every PKI application will use the KU and EKU fields and in fact must.
Check with the application (e.g, NPS) which KU and EKU parameters it will accept in the resulting certificate. A lot of the certificate templates basically issue Server Authentication EKU certificates making them largely equivalent, but it's still useful to use the right certificate templates for a few reasons:
- It makes it easier to determine why that certificate was issued
- and which component may be using it
- You can lock down the permissions so that only a few people can issue very privileged certificates
- You can issue and revoke certificates for each service instead of for the entire server/device
There are downsides though, including trying to force particular services to only use their specific (template) certificate when multiple certificates are installed on the same Windows server. If you're only really trying to provide simple connection security, then re-using one certificate for multiple purposes may not be an issue.
