Solved

Need to decomish a Windows 2003 DC that has an Enterprise Root CA

Posted on 2014-03-31
2
479 Views
Last Modified: 2014-03-31
We need to remove an Enterprise Root CA from a Windows 2003 DC so we can replace it with a Windows 2012 DC. We curently have two other Windows 2012 DC's on our domain one of which has the FSMO.
I understand it is best not to install the CA on a DC. so I need to know the steps to complete this process.
0
Comment
Question by:Slingshot51
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 4

Accepted Solution

by:
aa-denver earned 500 total points
ID: 39966965
Here is a comprehensive link.  

http://technet.microsoft.com/en-us/library/ee126170(v=ws.10).aspx

It is a good thing you asked.  Many people just demote a DC with a CA and then remove it from AD, leaving a mess behind.  The CA has probably been issuing server certs that will break if you do this.

Basically you have to export the CA database and import it to another server that has the same name.   Follow the guidance in this article and you should be OK.

I would encourage you to spin up a test VM environment, Microsoft Hyper-V should be OK.  You can P2V the existing DC CA to that environment and then isolate the test server from the network before turning on the VM copy of the DC.  I always recommend going through a virtual trial run before doing something like this.
0
 

Author Closing Comment

by:Slingshot51
ID: 39967207
Thank you for the information.
0

Featured Post

Free Webinar: AWS Backup & DR

Join our upcoming webinar with experts from AWS, CloudBerry Lab, and the Town of Edgartown IT to discuss best practices for simplifying online backup management and cutting costs.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This video Micro Tutorial explains how to clone a hard drive using a commercial software product for Windows systems called Casper from Future Systems Solutions (FSS). Cloning makes an exact, complete copy of one hard disk drive (HDD) onto another d…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…

696 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question