0

My CA server crashed. It was used to deploy certs to messenger clients for live communication. I am no longer using live communication. I removed the server object from AD but my clients and servers envent logs have a lot of the following entries

  1. Automatic certificate enrollment for local system failed to enroll for one Domain Controller certificate (0x800706ba). The RPC server is unavailable.

  2. DCOM was unable to communicate with the computer msgsvr01.mycompany.local using any of the configured protocols

What else do I need to remove form AD when removing a CA?

Thanks

Improve this question

2 Answers 2

Reset to default
2

Have a look here: http://support.microsoft.com/kb/889250

I removed an Enterprise CA from an AD domain (Windows 2003) that I "inhertied" and started w/ a new Enterprise CA with no ill effects by following the directions in that article, then put in a fresh deployment that worked fine following. All-in-all, I felt it went very smoothly.

Improve this answer
3
  • The crtutil key wouldn't be able to run on the DC because I never installed the cert services on that machine. It was only installed on the machine which was crashed.
    – Saif Khan
    Jun 25, 2009 at 16:42
  • You can extract certutil.exe from the Windows setup files if you want to use it on any of the later steps. The big thing that gets done w/ it is deleting the old machine's private key. The private key is already gone if that machine was lost. You can do all the other steps safely. You're going to have to guess on the common name of the old CA, but you probably know it.
    – Evan Anderson
    Jun 26, 2009 at 1:27
  • The info was excellent. I was able to remove all the entries and no event popped up in my logs for the last 12 hours.
    – Saif Khan
    Jun 26, 2009 at 15:37
1

I would check your GPOs to make sure they arn't pushing an auto enrolment policy

User Settings -> Windows Settings -> Security -> Public Key Policies/AutoEnrollment policies

Improve this answer
1
  • 1
    That's all well and good, but he needs to go thru the proper retirement procedure if he wants to fix this right and wants to be able to deploy a working Windows PKI later on.
    – Evan Anderson
    Jun 25, 2009 at 14:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .