• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 466
  • Last Modified:

Advice for creating an offline Domain Controller Certificate

We have a scenario where we have an Enterprise CA running on WIndows 2003 in forestA.  All DC's within the domainA have enrolled their own Domain Controller Certificates successfully.  We have another AD forest behind a firewall where we are looking to use the Enterprise CA to in ForestA to submit Domain Controller certificates to the other Domain Controllers in ForestB as it does not have its own CA.  This will be used for Secure LDAP communication.
Just a note: I am running Windows 2003 Standard Edition.
I have followed the following MS link to achieve this http://technet2.microsoft.com/windowsserver/en/library/d78843f2-f739-4d1f-84ca-f6337f5685d81033.mspx?mfr=true
It unfortunately dows not work for the domain controller template when I try to submit the request to the Enterprise CA is get the error message: The Specified Server Cannot Perform The Requested Operation. 0x9007003a (WIN32: 58). Denied by Policy Module
If I run the same request for a WebServer template it works fine.  I am wondering if it is a limitation of Standard Edition.  Although I changed the CA to Stand-Alone on a Standard Edition build and it worked fine.  I am in the process of Installing Windows 2003 Enterprise to check if it is a limitation.

Any ideas would be good

Cheers
0
clarkeyi
Asked:
clarkeyi
  • 2
1 Solution
 
tomo999Commented:
Could this have something to do with the fact that you are trying to issue certificates to DomainB from a CA that belongs to DomainA ?

Are both these domains in the same forest?
0
 
clarkeyiAuthor Commented:
These are two Forests, so separate domains.  I did try assigning the certificate within the same domain with the same error message unfortunatley.

Cheers
0
 
clarkeyiAuthor Commented:
The solution was to fix the DomainContoler template within ADSI edit
0
 
Computer101Commented:
PAQed with points refunded (190)

Computer101
EE Admin
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now