Solved

Domain Controller Certificate Renewal

Posted on 2009-04-11
2
1,114 Views
Last Modified: 2012-05-06
I am replacing the Entreprise CA's in our Forest. New CA's are in place and I am ready to revoke all domain controller certificates and turn off the old CA's. The process includes revoking all existing issued certificates. Microsoft doc is here - http://support.microsoft.com/kb/889250

I then need to remove all the revoked certificates on all the domain controllers and reboot them so they pick up a new certificate from the new CA's. This is easy enough to do via the Certificates MMC on each server, but there are 80 domain controllers and it would take a lot of time. Domain controllers are a mix of 2003 SP2 and 2008.

The KB article mentioned above mentions the dsstore command that can be used to remove certificates, but this command is not recognised on our servers (support tools are installed on the 2003 servers). In any case it looks like user interaction is required with this script and that makes it hard to automate.

Anyone know of a way to script the removal of certificates from the local store? I need a batch or VBscript so I can push it out remotely.



0
Comment
Question by:milott
2 Comments
 
LVL 31

Accepted Solution

by:
Paranormastic earned 500 total points
ID: 24129832
Re-read the article a little more closely.  Dsstore.exe is for win2k DCs only.   For 03/08 DCs you don't need that, just run:

certutil -dcinfo deleteBad

If the certs were revoked or expired that will clean them up.  You can just throw that into a simple batch script.
0
 

Author Comment

by:milott
ID: 24181163
Sorry for the delay - took a week off for Easter.

Thanks I did spot that on a second read and tried it. certutil -dcinfo deleteBad identified the revoked certificates but did not remove them from the remote servers.

I found however that it sorted itself out over several days as the DC's all picked up new certs from the new CA's automatically.

thanks
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
This article explains the steps required to use the default Photos screensaver to display branding/corporate images
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question