Solved

Remove Certificate Services

Posted on 2009-04-14
2
1,256 Views
Last Modified: 2012-08-13
We currently have certificate services installed on one of our domain controllers (Windows 2003 Functional Domain) We are only using certificate services to issue an internal SSL key on one of our internal web servers.  We recently renamed our Domain and as you would expect, the certificate is now broken.  I am wondering if we can just uninstall Certificate Services, re-install certificate services on a different member server and re-issue the certificate to the internal web server.  Everything I have found online talks about moving certificate services to a different computer, not uninstalling it.  I looked through all the certificates that have been issued and we only have one that is currently not expired and that is the one on our internal web server.  

We are also getting the following errors on our Domain Controllers

Source AutoEnrollment
Event ID 13

Automatic certificate enrollment for local system failed to enroll for one Domain Controller certificate (0x80070005).  Access is denied.

So I am a little nervous about removing Certificate Services, because I am not sure how this will affect our Domain Controllers.
0
Comment
Question by:zoosysop
2 Comments
 
LVL 32

Expert Comment

by:Kamran Arshad
ID: 24145657
0
 
LVL 31

Accepted Solution

by:
Paranormastic earned 500 total points
ID: 24147590
The event id 13 is happening because you need to put the domain controllers group for your new domain into the CERTSRV_DCOM_ACCESS group - this may be a domain group if your CA was on a DC, otherwise it would be a local group on the CA box.

Since the name of the CA changed due to the rename, the only real way around this is to reinstall with a new certificate.  To best avoid issues, it would be best to completely remove the old CA from AD prior to reinstalling it.

I would also recommend taking a full backup including system state and archiving that for a bit, just in case you need to restore the old one.  Or just take the box offline and physically archive it.

How to decom a CA server properly from AD:
http://support.microsoft.com/kb/889250
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Experts-Exchange users below are the steps you can follow to upgrade your Lync server to latest CU's or cumulative updates. Note: Perform it during non-production hours.   Step 1: Backup your lync and SQL server database. Follow below article: h…
This article offers some helpful and general tips for safe browsing and online shopping. It offers simple and manageable procedures that help to ensure the safety of one's personal information and the security of any devices.
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now