When ADCS uses sha1 for their certificates, you might want to change it to sha254.

NOTE: Make sure all your devices support sha256

sha1

sha256

To achieve this enter the following commands in an elivated DOS-box:

certutil -setreg cacspCNGHashAlgorithm SHA256
net stop certsvc
net start certsvc