Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We moved from a SBS 2003 Server to a SBS 2008 server relatively recently because the SBS 2003 was having major hardware issues. I followed the Migration guide to the letter and everything seemed to go smooth. Until after this last update. I noticed that AD Certificate service was not started... I started it and it stopped immediately. So I went to Certification Authority MMC and tried to start the service from there and got the following:

Error 0xxc8000147 (ESE: -327)

So went to the error log and here the associated log:

Log Name: Application Source:

Date: 5/23/2011 7:29:42 AM

Event ID: 17

Task Category: None

Level: Error

Keywords: Classic


Computer: ***.****.lan

Description: Active Directory Certificate Services did not start: Unable to initialize the database connection for ***-**-CA. Error 0xc8000147 (ESE: -327).

Event Xml:

<Event xmlns="">
    <Provider Name="Microsoft-Windows-CertificationAuthority" 
        EventSourceName="CertSvc" />
    <EventID Qualifiers="49754">17</EventID> 
    <TimeCreated SystemTime="2011-05-23T14:29:42.000Z" />
    <Correlation />

    <Execution ProcessID="0" ThreadID="0" />
    <Security UserID="*****" />   
  <EventData Name="MSG_E_DB_INIT_FAILED">
    <Data Name="CACommonName">*********-*********-CA</Data>
    <Data Name="ErrorCode">Error 0xc8000147 (ESE: -327)</Data>   

I have been searching for solutions to this issue and really haven't found anything related to the error code for CA services.

share|improve this question
try running the command "dcdiag" on the new server to see if it leads you in a better direction of getting a usable error message. I think that Microsoft offers free migration customer support. – Nixphoe May 23 '11 at 15:42
running dcdiag it passed all tests – user76534 May 23 '11 at 22:16

I recommend removing and reinstalling the Certificate Authority role. This is expressly supported by MS and they even provide an SBS2008 HOWTO here.

share|improve this answer

eseutil worked for me after I accidently deleted everything in CertLog rather than just the log files.

With the AD Certificate service still stopped, I copied back the edb and jrs files, then ran eseutil /p on the edb (note without the logs) and it repaired the database.

I then started AD Certificate services without a problem.

share|improve this answer
cd \windows\system32\certlog

esentutl /p "sbs2008-ca.edb"


repadmin /syncall
share|improve this answer
To make this a useful answer, please add an explanation what this does and how it helps to solve the OPs problem. – Sven Dec 31 '14 at 17:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.