up vote 0 down vote favorite
share [g+] share [fb]

My CA server crashed. It was used to deploy certs to messenger clients for live communication. I am no longer using live communication. I removed the server object from AD but my clients and servers envent logs have a lot of the following entries

  1. Automatic certificate enrollment for local system failed to enroll for one Domain Controller certificate (0x800706ba). The RPC server is unavailable.

  2. DCOM was unable to communicate with the computer msgsvr01.mycompany.local using any of the configured protocols

What else do I need to remove form AD when removing a CA?

Thanks

link|improve this question
76% accept rate
feedback

2 Answers

up vote 2 down vote accepted

Have a look here: http://support.microsoft.com/kb/889250

I removed an Enterprise CA from an AD domain (Windows 2003) that I "inhertied" and started w/ a new Enterprise CA with no ill effects by following the directions in that article, then put in a fresh deployment that worked fine following. All-in-all, I felt it went very smoothly.

link|improve this answer
The crtutil key wouldn't be able to run on the DC because I never installed the cert services on that machine. It was only installed on the machine which was crashed. – Saif Khan Jun 25 '09 at 16:42
You can extract certutil.exe from the Windows setup files if you want to use it on any of the later steps. The big thing that gets done w/ it is deleting the old machine's private key. The private key is already gone if that machine was lost. You can do all the other steps safely. You're going to have to guess on the common name of the old CA, but you probably know it. – Evan Anderson Jun 26 '09 at 1:27
The info was excellent. I was able to remove all the entries and no event popped up in my logs for the last 12 hours. – Saif Khan Jun 26 '09 at 15:37
Glad I could help. – Evan Anderson Jun 26 '09 at 17:06
feedback
up vote 1 down vote

I would check your GPOs to make sure they arn't pushing an auto enrolment policy

User Settings -> Windows Settings -> Security -> Public Key Policies/AutoEnrollment policies

link|improve this answer
1  
That's all well and good, but he needs to go thru the proper retirement procedure if he wants to fix this right and wants to be able to deploy a working Windows PKI later on. – Evan Anderson Jun 25 '09 at 14:50
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.