Re: Certs for Domain Controllers-Trying to Prevent an Issue

Easiest would be to deploy a proper PKI (not piggy-backing a CA on a DC)
You can use certutil -dcinfo deleteALL to replace the certs after the new PKI is deployed
You cannot restore the CA. If you read the installation warning, you cannot change the domain or NetBIOS name of the CA after installing Cert Services

Brian
"Christian" <nospam@xxxxxxxxx> wrote in message news:VabEj.160559$3y2.117963@xxxxxxxxxxxxxxxxxxxxxxxxx
Reposting this issue. It was recommended that I post to this group from someone in the AD group.

We have three DC's, all running Windows Server 2003 w/SP2. DC1 is unstable,
and needs to be demoted before there is a serious hardware failure. DC2 and
DC3 have been brought online, and all of the FSMO roles have been moved to
them. The one remaining issue is that DC1 issued the Domain Controller
certs to DC2 and DC3. No other certs in our environment where created by
DC1, just the Domain Controller certs for DC2 and DC3. What needs to be
done in order to allow the demotion of DC1 out of AD without affecting the
certs? This server will be salvaged after the demotion.

Thank you,

-Christian


.

Relevant Pages

  • Demote first DC in a Windows 2003 domain. What happens to the certs?
    ... all running Windows Server 2003 w/SP2. ... DC3 have been brought online, and all of the FSMO roles have been moved to ... The one remaining issue is that DC1 issued the Domain Controller ... No other certs in our environment where created by ...
    (microsoft.public.windows.server.security)
  • Certs for Domain Controllers-Trying to Prevent an Issue
    ... all running Windows Server 2003 w/SP2. ... DC3 have been brought online, and all of the FSMO roles have been moved to ... The one remaining issue is that DC1 issued the Domain Controller ... No other certs in our environment where created by ...
    (microsoft.public.windows.server.security)
  • Re: Certs for Domain Controllers-Trying to Prevent an Issue
    ... I'm reading your w2k3 PKi book right now and like it very much. ... You can use certutil -dcinfo deleteALL to replace the certs after the new PKI is deployed ... DC3 have been brought online, and all of the FSMO roles have been moved to ... The one remaining issue is that DC1 issued the Domain Controller ...
    (microsoft.public.windows.server.security)
  • Re: Certs for Domain Controllers-Trying to Prevent an Issue
    ... "Jorge de Almeida Pinto [MVP - DS]" wrote in message ... You can use certutil -dcinfo deleteALL to replace the certs after the new PKI is deployed ... The one remaining issue is that DC1 issued the Domain Controller ...
    (microsoft.public.windows.server.security)
  • Demote DC at the root of the Cert Path?
    ... DC3 have been brought online, and all of the FSMO roles have been moved to ... certs to DC2 and DC3. ... No other certs in our environment where created by ... This server will be salvaged after the demotion. ...
    (microsoft.public.windows.server.active_directory)