Solved

Remove Certificate Services

Posted on 2009-04-14
2
1,255 Views
Last Modified: 2012-08-13
We currently have certificate services installed on one of our domain controllers (Windows 2003 Functional Domain) We are only using certificate services to issue an internal SSL key on one of our internal web servers.  We recently renamed our Domain and as you would expect, the certificate is now broken.  I am wondering if we can just uninstall Certificate Services, re-install certificate services on a different member server and re-issue the certificate to the internal web server.  Everything I have found online talks about moving certificate services to a different computer, not uninstalling it.  I looked through all the certificates that have been issued and we only have one that is currently not expired and that is the one on our internal web server.  

We are also getting the following errors on our Domain Controllers

Source AutoEnrollment
Event ID 13

Automatic certificate enrollment for local system failed to enroll for one Domain Controller certificate (0x80070005).  Access is denied.

So I am a little nervous about removing Certificate Services, because I am not sure how this will affect our Domain Controllers.
0
Comment
Question by:zoosysop
2 Comments
 
LVL 32

Expert Comment

by:Kamran Arshad
ID: 24145657
0
 
LVL 31

Accepted Solution

by:
Paranormastic earned 500 total points
ID: 24147590
The event id 13 is happening because you need to put the domain controllers group for your new domain into the CERTSRV_DCOM_ACCESS group - this may be a domain group if your CA was on a DC, otherwise it would be a local group on the CA box.

Since the name of the CA changed due to the rename, the only real way around this is to reinstall with a new certificate.  To best avoid issues, it would be best to completely remove the old CA from AD prior to reinstalling it.

I would also recommend taking a full backup including system state and archiving that for a bit, just in case you need to restore the old one.  Or just take the box offline and physically archive it.

How to decom a CA server properly from AD:
http://support.microsoft.com/kb/889250
0

Featured Post

Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

Join & Write a Comment

Experts-Exchange users below are the steps you can follow to upgrade your Lync server to latest CU's or cumulative updates. Note: Perform it during non-production hours.   Step 1: Backup your lync and SQL server database. Follow below article: h…
Trying to figure out group policy inheritance and which settings apply where can be a chore.  Here's a very simple summary I've written which might help.  Keep in mind, this is just a high-level conceptual overview where I try to avoid getting bogge…
Internet Business Fax to Email Made Easy - With eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, fr…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now