Solved

Domain Controller Certificate Authority Recovery

Posted on 2014-04-11
3
415 Views
Last Modified: 2014-06-11
I recently took over with a company and am working through various issues left by the previous sysadmin. The domain functional level is Windows Server 2008 R2. On the domain controllers I am getting this error in the event log every 6 hours or so.


Application Log Event ID 13
¿Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from PM-vDC-01.domainname.com\domainname-PM-VDC-01-CA (The RPC server is unavailable. 0x800706ba (WIN32: 1722)).


I would like to clear this alert. How can I go about removing references to the machine pm-vdc-01 which no longer exists (it was decommissioned before I started so I have no history of the device). Would it be necessary to create a new CA for the domain and will there be any repercussions by removing the CA reference. Lastly would it be necessary to create a CA for the domain?
0
Comment
Question by:PM_IT
  • 2
3 Comments
 
LVL 36

Accepted Solution

by:
Mahesh earned 500 total points
ID: 39994981
The event will not harm any thing

You can navigate to AD sites and services and from view   menu select "service node" which will enable you to view configured CA
Then you can view Public key services for any configured CA servers under services folder

Ensure that above CA is already removed from server

Its not mandatory to have a CA server, its optional and you can deploy one if wanted to

Just check all GPOs for any certificate Autoenrollment policy is set, if found one just remove that setting from policy

Also on Domain controller check local computer personnel certificate store and delete if you found any Domain controller certificate pointing to old certificate authority

Check below article to remove CA services completely from AD
Remove all Certification Services objects from Active Directory

If you installed new AD integrated enterprise CA server, it will again install domain controller certificate on DC

Mahesh
0
 
LVL 1

Author Comment

by:PM_IT
ID: 40064894
Mahesh thanks for the link. I've been busy and just getting back to this. Based on the article provided it seems I could skip to step 6. How would I handle certificate revocation since the CA is no longer available and would I need to remove any certificates from current machines that were issued by the original CA?
0
 
LVL 36

Expert Comment

by:Mahesh
ID: 40065369
Yes you are right, you could directly jump to step 6
Since CA is already decommissioned \ removed from network, you can remove all old certificates issued by that CA on client computers and servers if wanted to
It will not create any problems if it remains in local certificate personnel store on client computers, however if you try to assign \ use those certificates to any services, then it will give you error
Because those certificates won't get CA revocation

You could deploy new AD integrated CA and enroll new certificates to all if required
0

Featured Post

Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…

785 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question