Domain Controller Certificate Authority Recovery

Posted on 2014-04-11
Medium Priority
Last Modified: 2014-06-11
I recently took over with a company and am working through various issues left by the previous sysadmin. The domain functional level is Windows Server 2008 R2. On the domain controllers I am getting this error in the event log every 6 hours or so.

Application Log Event ID 13
¿Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from PM-vDC-01.domainname.com\domainname-PM-VDC-01-CA (The RPC server is unavailable. 0x800706ba (WIN32: 1722)).

I would like to clear this alert. How can I go about removing references to the machine pm-vdc-01 which no longer exists (it was decommissioned before I started so I have no history of the device). Would it be necessary to create a new CA for the domain and will there be any repercussions by removing the CA reference. Lastly would it be necessary to create a CA for the domain?
Question by:Snagajob IT
  • 2
LVL 40

Accepted Solution

Mahesh earned 2000 total points
ID: 39994981
The event will not harm any thing

You can navigate to AD sites and services and from view   menu select "service node" which will enable you to view configured CA
Then you can view Public key services for any configured CA servers under services folder

Ensure that above CA is already removed from server

Its not mandatory to have a CA server, its optional and you can deploy one if wanted to

Just check all GPOs for any certificate Autoenrollment policy is set, if found one just remove that setting from policy

Also on Domain controller check local computer personnel certificate store and delete if you found any Domain controller certificate pointing to old certificate authority

Check below article to remove CA services completely from AD
Remove all Certification Services objects from Active Directory

If you installed new AD integrated enterprise CA server, it will again install domain controller certificate on DC


Author Comment

by:Snagajob IT
ID: 40064894
Mahesh thanks for the link. I've been busy and just getting back to this. Based on the article provided it seems I could skip to step 6. How would I handle certificate revocation since the CA is no longer available and would I need to remove any certificates from current machines that were issued by the original CA?
LVL 40

Expert Comment

ID: 40065369
Yes you are right, you could directly jump to step 6
Since CA is already decommissioned \ removed from network, you can remove all old certificates issued by that CA on client computers and servers if wanted to
It will not create any problems if it remains in local certificate personnel store on client computers, however if you try to assign \ use those certificates to any services, then it will give you error
Because those certificates won't get CA revocation

You could deploy new AD integrated CA and enroll new certificates to all if required

Featured Post

Get 10% Off Your First Squarespace Website

Ready to showcase your work, publish content or promote your business online? With Squarespace’s award-winning templates and 24/7 customer service, getting started is simple. Head to Squarespace.com and use offer code ‘EXPERTS’ to get 10% off your first purchase.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Sometimes it necessary to set special permissions on user objects.  For instance when using a Blackberry server, the SendAs permission needs to be set. I see many admins struggle with the setting that permission only to see it disappear within a few…
I’m willing to make a bet that your organization stores sensitive data in your Windows File Servers; files and folders that you really don’t want making it into the wrong hands.
This tutorial will walk an individual through the steps necessary to install and configure the Windows Server Backup Utility. Directly connect an external storage device such as a USB drive, or CD\DVD burner: If the device is a USB drive, ensure i…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

624 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question