Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a network using Windows Server 2003 with Active Directory. A few years ago I set up the Certificate Authority on one of the servers. Recently I wanted to do some maintenance, but found that the CA on that machine hasn't been issuing certificates since 2007, and yet users on the network are getting Auto-enrolled certificates all the time, so SOMETHING must be issuing them.

How do I tell which machine is the active CA?

share|improve this question
up vote 2 down vote accepted

CertUtil.exe will give you most of the information you want. There's a very good blog posting by Tony Murray on his blog here about using Certutil and querying the AD for the info you want.

share|improve this answer

Examine one of those certificates and have a look at who issued it.

share|improve this answer
Doesn't help. The "issuer" is my own username, or the username of whoever the certificate belongs to. It doesn't say which hostname the CA was from. – Chris Wenham Nov 4 '09 at 19:37
That's not correct. The certificate should contain the path to the issuing CA(s). Guess something strange is happening here... – Massimo Nov 4 '09 at 21:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.