up vote 1 down vote favorite
share [g+] share [fb]

Is it possible to run a W2k8 Enterprise (AD-integrated) Certificate Authority on a server that it not a domain controller - mine currently is a DC and I do not remember whether this was a requirement? If so, can I run dcpromo to demote a server that currently is DC and runs the CA without invalidating that CA? I assume the answer to my first question should be "yes", because the server is only RODC, but I need to be sure not to accidentally destroy the CA.

link|improve this question
67% accept rate
I think so, might want to make sure you have another DC around first :). Hopefully someone more authoritative on this can give you an "answer" – SpacemanSpiff Nov 17 '11 at 19:02
I have two writable DCs for managing the domain. From the observed system behaviour, I think that the CA ist interacting with the PDC and not with the RODC role on the same machine anyway. – Christoph Nov 17 '11 at 19:14
feedback

1 Answer

up vote 2 down vote accepted

Yes, it is possible to run the CA on a non-DC server. This is how our domain is set up. CA entries are published to a special area of Active Directory and does not require that a DC role be installed on the same server.

You should be able to dcpromo the server back to a non-DC role without any issue; the DC and CA roles are distinct from each other. Of course, I would recommend first making a backup of your CA (see http://technet.microsoft.com/en-us/library/cc725565.aspx). That way, if you have any issues whatsoever, you can restore your CA on a new server instance.

link|improve this answer
That actually works, but I want to add some details for others in the same situation: You actually cannot uninstall the DC role while the CA role is installed. Therefore, you must backup the CA, remove the CA role, remove the DC role, re-add the CA role and restore the CA (technet.microsoft.com/en-us/library/ee126140(WS.10).aspx). – Christoph Nov 18 '11 at 17:36
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.