Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm seeing this error in my Active Directory log. The error is on my primary dc which is an SBS 2008 box. The computer performing the request is my secondary dc running server 2008 r2.

Active Directory Certificate Services could not process request ## due to an error: The request's current status does not allow this operation. 0x80094003 (-2146877437). The request was for domain\server2008r2$.

I have these errors in the r2 servers logs:

Automatic certificate enrollment for local system failed (0x800b0101) A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. .

Certificate for local system with Thumbprint ###################### is about to expire or already expired.

How can I resolve these?

Edit: Just wanted to add that the CA snap-in reports that the request failed due to a parsing error.

Edit 2: In my primary domain controller (the sbs 2008 server) it looks like the root cert has expired. Ive tried both renewing and requesting a new one, but it says no templates are valid.

share|improve this question
Have you looked at the certificates on the DC2 box if they expired? Has the CA Cert itself expired? – MichelZ May 22 '14 at 5:43
Yes, the DC2s computer cert expired and attempting to renew gives the errors above. – Andy May 22 '14 at 23:37

This typically caused by the Certificate Authority for your domain's Active Directory Certificate Services being unavailable. Try looking into why your Domain Controller cannot participate in auto-enrollment.

share|improve this answer
The CA indicates a parse error, but I wasn't able to find something for that specific problem in the links from your answer. – Andy May 23 '14 at 0:03
up vote 0 down vote accepted

I've figured this out. As indicated in my edits, the root cause was the root certificate in my pdc had expired. The fix was to open the Certificate Authority snap in and right click on the server in the tree on the left and go to All Tasks and at the bottom select Renew CA Certification. This gave me a dialog but when I clicked OK I had an error saying it couldn't create the certification, permission denied and Object already existed. I found that if I stopped ADCS and then went to ProgramData\Microsoft\Crypto\RSA\MachineKeys and sorted them by date, so the most recent was at the top. I opened it with Notepad and I recognized that the name of the object I was being told existed. I moved the file to the desktop and restarted ADCS and retried renewing the CA cert. It worked this time. I verified this also fixed the issue on other backup DC by successfully doing a gpupdate /force and saw none of the errors I was getting.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.