Solved

Remove Certificate Services

Posted on 2009-04-14
2
1,258 Views
Last Modified: 2012-08-13
We currently have certificate services installed on one of our domain controllers (Windows 2003 Functional Domain) We are only using certificate services to issue an internal SSL key on one of our internal web servers.  We recently renamed our Domain and as you would expect, the certificate is now broken.  I am wondering if we can just uninstall Certificate Services, re-install certificate services on a different member server and re-issue the certificate to the internal web server.  Everything I have found online talks about moving certificate services to a different computer, not uninstalling it.  I looked through all the certificates that have been issued and we only have one that is currently not expired and that is the one on our internal web server.  

We are also getting the following errors on our Domain Controllers

Source AutoEnrollment
Event ID 13

Automatic certificate enrollment for local system failed to enroll for one Domain Controller certificate (0x80070005).  Access is denied.

So I am a little nervous about removing Certificate Services, because I am not sure how this will affect our Domain Controllers.
0
Comment
Question by:zoosysop
2 Comments
 
LVL 32

Expert Comment

by:Kamran Arshad
ID: 24145657
0
 
LVL 31

Accepted Solution

by:
Paranormastic earned 500 total points
ID: 24147590
The event id 13 is happening because you need to put the domain controllers group for your new domain into the CERTSRV_DCOM_ACCESS group - this may be a domain group if your CA was on a DC, otherwise it would be a local group on the CA box.

Since the name of the CA changed due to the rename, the only real way around this is to reinstall with a new certificate.  To best avoid issues, it would be best to completely remove the old CA from AD prior to reinstalling it.

I would also recommend taking a full backup including system state and archiving that for a bit, just in case you need to restore the old one.  Or just take the box offline and physically archive it.

How to decom a CA server properly from AD:
http://support.microsoft.com/kb/889250
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Microsoft has released remote PowerShell capabilities to all commercial Office 365 customers. So you can be controlled via PowerShell and not from the Office 365 admin center Download Windows PowerShell Module for Lync Online http://www.micros…
The Need In an Active Directory enviroment, the PDC emulator provide time synchronization for the domain. This is important since Active Directory uses Kerberos for authentication.  By default, if the time difference between systems is off by more …
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.

803 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question