2

Because I want to test SSL in the local domain I've installed Enterprise Certificate Authority with the use of this tutorial.

The Install went successful and after install I rebooted the DC. While starting up it takes a long time to get past the "Setting User Settings" information screen and when I look in Server Manager after start-up I see al sorts of warnings because of the delay and one error in CA:

ID: 91 - Could not connect to the Active Directory. Active Directory Certificate Services will retry when processing requires Active Directory access.

Does anyone understand what I could have missed what's causing the start-up delay now? Any tips for troubleshooting this are appreciated.

More info: I just followed all tips in this article. Everything was fine but in the "Confirm permissions on essential AD DS containers and objects" part I'm missing 2 folders they mention in the public key services node:

  1. NTAuthCertificates object
  2. Domain Computers and Domain Users containers.

Not sure if this is a problem just thought I mention it.

Again more info: I found another warning: The WinRM service failed to create the following SPNs

I fixed this in ADSIEDIT.MSC by giving the Network Service the correct rights on the CN. After this the server started faster. (have to reboot more and try to fix more warnings)

Another edit: Did one more reboot and the delay is back so the SPN fix didn't fix the slow start problem

Another Edit: Starting the advice to build a secondary DC/DNS server to see if it helps for the slow start-up. The good news it will help for sure for many other things!

Last Edit! Ryan's advice was SPOT on! Adding the second DC/DNS server made this problem go away at once!

2
  • This is not your only DC is it?
    – Ryan Ries
    Jul 25, 2012 at 23:53
  • Hi Ryan, yes this is my only domain controller. we still need to set-up the second one for redundancy but for now I have one. Does that give you clues to my problem? Jul 25, 2012 at 23:58

1 Answer 1

4

Well, given the information that you posted gives me the hint that the DC is trying to access Active Directory during boot, but it can't because it is the only DC so Active Directory has not started yet. I would bet money that the issues goes away if you add another DC to the domain.

The WinRM error is just a side-effect... again, it is unable to register an SPN because Active Directory is required to register an SPN, and Active Directory is not ready yet.

5
  • Hi Ryan. Thanks and ofc what you're saying makes sense but this problem did not occur before I installed the CA today. We will add the second DC but this will not be over night. If there are no other explanations then I have to get back to this topic after I have the second DC. Jul 26, 2012 at 0:07
  • 1
    Sure, but now you have an ECA which does store information in Active Directory... which may not be available yet since the machine is still booting up. This is just a guess, but you might try setting the Certificate Services service to "Delayed Start" ... maybe that will help.
    – Ryan Ries
    Jul 26, 2012 at 0:15
  • Hi Ryan. Oh I forgot to mention but 20 minutes ago I changed this service to delayed start and it did not help. But basically all your saying is making sense to me. And its not the first time somebody told me I need to get my secondary DC on-line. :) So perhaps I should hurry a bit more in that area.. Again thanks for your advice and I will see in the morning if I can start this important task. Jul 26, 2012 at 0:29
  • Hi Ryan. After a good night sleep I decided today to start setting up the secondary DC and DNS Server. So I'm doing this right now. When I'm done I'm going to report back the results! Jul 26, 2012 at 15:28
  • Hi Ryan. Ok 2 hours later and we have our second DC/DNS server up and running my god updating windows is... :) But your analysis of my problem was SPOT on the problem is GONE. Thank you! I still have to fix a lot of warning and fine tune configurations but its looking very good. Jul 26, 2012 at 17:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .