Solved

Domain Controller Certificate Renewal

Posted on 2009-04-11
2
1,141 Views
Last Modified: 2012-05-06
I am replacing the Entreprise CA's in our Forest. New CA's are in place and I am ready to revoke all domain controller certificates and turn off the old CA's. The process includes revoking all existing issued certificates. Microsoft doc is here - http://support.microsoft.com/kb/889250

I then need to remove all the revoked certificates on all the domain controllers and reboot them so they pick up a new certificate from the new CA's. This is easy enough to do via the Certificates MMC on each server, but there are 80 domain controllers and it would take a lot of time. Domain controllers are a mix of 2003 SP2 and 2008.

The KB article mentioned above mentions the dsstore command that can be used to remove certificates, but this command is not recognised on our servers (support tools are installed on the 2003 servers). In any case it looks like user interaction is required with this script and that makes it hard to automate.

Anyone know of a way to script the removal of certificates from the local store? I need a batch or VBscript so I can push it out remotely.



0
Comment
Question by:milott
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 31

Accepted Solution

by:
Paranormastic earned 500 total points
ID: 24129832
Re-read the article a little more closely.  Dsstore.exe is for win2k DCs only.   For 03/08 DCs you don't need that, just run:

certutil -dcinfo deleteBad

If the certs were revoked or expired that will clean them up.  You can just throw that into a simple batch script.
0
 

Author Comment

by:milott
ID: 24181163
Sorry for the delay - took a week off for Easter.

Thanks I did spot that on a second read and tried it. certutil -dcinfo deleteBad identified the revoked certificates but did not remove them from the remote servers.

I found however that it sorted itself out over several days as the DC's all picked up new certs from the new CA's automatically.

thanks
0

Featured Post

Creating Instructional Tutorials  

For Any Use & On Any Platform

Contextual Guidance at the moment of need helps your employees/users adopt software o& achieve even the most complex tasks instantly. Boost knowledge retention, software adoption & employee engagement with easy solution.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article demonstrates probably the easiest way to configure domain-wide tier isolation within Active Directory. If you do not know tier isolation read https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/s…
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
Suggested Courses

632 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question