Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to run a W2k8 Enterprise (AD-integrated) Certificate Authority on a server that it not a domain controller - mine currently is a DC and I do not remember whether this was a requirement? If so, can I run dcpromo to demote a server that currently is DC and runs the CA without invalidating that CA? I assume the answer to my first question should be "yes", because the server is only RODC, but I need to be sure not to accidentally destroy the CA.

share|improve this question
I think so, might want to make sure you have another DC around first :). Hopefully someone more authoritative on this can give you an "answer" – SpacemanSpiff Nov 17 '11 at 19:02
I have two writable DCs for managing the domain. From the observed system behaviour, I think that the CA ist interacting with the PDC and not with the RODC role on the same machine anyway. – Christoph Nov 17 '11 at 19:14
up vote 2 down vote accepted

Yes, it is possible to run the CA on a non-DC server. This is how our domain is set up. CA entries are published to a special area of Active Directory and does not require that a DC role be installed on the same server.

You should be able to dcpromo the server back to a non-DC role without any issue; the DC and CA roles are distinct from each other. Of course, I would recommend first making a backup of your CA (see That way, if you have any issues whatsoever, you can restore your CA on a new server instance.

share|improve this answer
That actually works, but I want to add some details for others in the same situation: You actually cannot uninstall the DC role while the CA role is installed. Therefore, you must backup the CA, remove the CA role, remove the DC role, re-add the CA role and restore the CA ( – Christoph Nov 18 '11 at 17:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.