Solved

Advice for creating an offline Domain Controller Certificate

Posted on 2007-12-04
5
447 Views
Last Modified: 2008-05-31
We have a scenario where we have an Enterprise CA running on WIndows 2003 in forestA.  All DC's within the domainA have enrolled their own Domain Controller Certificates successfully.  We have another AD forest behind a firewall where we are looking to use the Enterprise CA to in ForestA to submit Domain Controller certificates to the other Domain Controllers in ForestB as it does not have its own CA.  This will be used for Secure LDAP communication.
Just a note: I am running Windows 2003 Standard Edition.
I have followed the following MS link to achieve this http://technet2.microsoft.com/windowsserver/en/library/d78843f2-f739-4d1f-84ca-f6337f5685d81033.mspx?mfr=true
It unfortunately dows not work for the domain controller template when I try to submit the request to the Enterprise CA is get the error message: The Specified Server Cannot Perform The Requested Operation. 0x9007003a (WIN32: 58). Denied by Policy Module
If I run the same request for a WebServer template it works fine.  I am wondering if it is a limitation of Standard Edition.  Although I changed the CA to Stand-Alone on a Standard Edition build and it worked fine.  I am in the process of Installing Windows 2003 Enterprise to check if it is a limitation.

Any ideas would be good

Cheers
0
Comment
Question by:clarkeyi
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
5 Comments
 
LVL 4

Expert Comment

by:tomo999
ID: 20404697
Could this have something to do with the fact that you are trying to issue certificates to DomainB from a CA that belongs to DomainA ?

Are both these domains in the same forest?
0
 

Author Comment

by:clarkeyi
ID: 20405139
These are two Forests, so separate domains.  I did try assigning the certificate within the same domain with the same error message unfortunatley.

Cheers
0
 

Author Comment

by:clarkeyi
ID: 20418234
The solution was to fix the DomainContoler template within ADSI edit
0
 
LVL 1

Accepted Solution

by:
Computer101 earned 0 total points
ID: 20615345
PAQed with points refunded (190)

Computer101
EE Admin
0

Featured Post

How to Defend Against the WCry Ransomware Attack

On May 12, 2017, an extremely virulent ransomware variant named WCry 2.0 began to infect organizations. Within several hours, over 75,000 victims were reported in 90+ countries. Learn more from our research team about this threat & how to protect your organization!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Samsung dvr sdr-5102n2t not working 7 59
http response code 3 38
Configure Windows Server 2012 time server 3 38
wannacrypt movement 9 76
Ransomware is a malware that is again in the list of security  concerns. Not only for companies, but also for Government security and  even at personal use. IT departments should be aware and have the right  knowledge to how to fight it.
Smart phones, smart watches, Bluetooth-connected devices—the IoT is all around us. In this article, we take a look at the security implications of our highly connected world.
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

738 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question