Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have inherited an Active Directory domain where certificate services were installed and not put to good use, and not documented. I would like to revamp the infrastructure and actually use the services for many security related applications, but I am unsure what to expect or where to begin. Basically, I am wondering if any one else has had a similar issue and what process was used. I would ultimately like to start over and do things correctly, but I have not found out if this is possible, or if there are any applications that may break. From what I have found so far, the service was mainly used to supply development sites with certificates. Users are issued certificates, but I have never come across any instance of them being used. Any information/help is much appreciated.


share|improve this question

I've removed an Enterprise CA from an AD domain (Windows 2003) I "inhertied" and started w/ a new Enterprise CA with no ill effects. I followed the directions in this article and then started with a fresh deployment.

All-in-all, I felt it went very smoothly.

(My Customer was similar to yours, probably. They'd installed it, didn't use it for anything, and then were on the verge of trashing the machine running the enterprise CA root. I needed certificates for WPA2-RADIUS authentication and ended up walking right into a rats nest of junk.)

share|improve this answer

If you are 100% positive that the certs aren't being used then you can follow KB 889250 and decomission. But you have to make sure they are not being used first, because the worst case scenario is that half way thru superimportantapp is broken and you have to fix the PKI you just broke in order to get it back up and running. Once you do certutil -delkey CertificateAuthorityName, getting the certs to work again get interesting to say the least. Above all else take your time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.