Domain Controller Certificate Authority Recovery

I recently took over with a company and am working through various issues left by the previous sysadmin. The domain functional level is Windows Server 2008 R2. On the domain controllers I am getting this error in the event log every 6 hours or so.


Application Log Event ID 13
¿Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from PM-vDC-01.domainname.com\domainname-PM-VDC-01-CA (The RPC server is unavailable. 0x800706ba (WIN32: 1722)).


I would like to clear this alert. How can I go about removing references to the machine pm-vdc-01 which no longer exists (it was decommissioned before I started so I have no history of the device). Would it be necessary to create a new CA for the domain and will there be any repercussions by removing the CA reference. Lastly would it be necessary to create a CA for the domain?
LVL 1
Snagajob ITAsked:
Who is Participating?
 
MaheshConnect With a Mentor ArchitectCommented:
The event will not harm any thing

You can navigate to AD sites and services and from view   menu select "service node" which will enable you to view configured CA
Then you can view Public key services for any configured CA servers under services folder

Ensure that above CA is already removed from server

Its not mandatory to have a CA server, its optional and you can deploy one if wanted to

Just check all GPOs for any certificate Autoenrollment policy is set, if found one just remove that setting from policy

Also on Domain controller check local computer personnel certificate store and delete if you found any Domain controller certificate pointing to old certificate authority

Check below article to remove CA services completely from AD
Remove all Certification Services objects from Active Directory

If you installed new AD integrated enterprise CA server, it will again install domain controller certificate on DC

Mahesh
0
 
Snagajob ITAuthor Commented:
Mahesh thanks for the link. I've been busy and just getting back to this. Based on the article provided it seems I could skip to step 6. How would I handle certificate revocation since the CA is no longer available and would I need to remove any certificates from current machines that were issued by the original CA?
0
 
MaheshArchitectCommented:
Yes you are right, you could directly jump to step 6
Since CA is already decommissioned \ removed from network, you can remove all old certificates issued by that CA on client computers and servers if wanted to
It will not create any problems if it remains in local certificate personnel store on client computers, however if you try to assign \ use those certificates to any services, then it will give you error
Because those certificates won't get CA revocation

You could deploy new AD integrated CA and enroll new certificates to all if required
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.