Tag Info

New answers tagged

0

Its not technically possible to have more than one PKI hierarchy on one server and its a bad idea from a security perspective as has been mentioned (single point of failure). The ADCS role ties into the server's identity in AD such that the only way to alter the DN of the hierarchy would be to blow the role away and start over. As far as licenses go, I ...


2

Certificate Templates are stored in the Configuration partition of Active Directory. For instance, if your Certificate Template is named "Smartcard," then its DN would be: CN=Smartcard,CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=Contoso,DC=Com The msPKI-Cert-Template-OID attribute of that object contains the OID you ...


1

My understanding is that you can only have one ADCS instance per host and up to 3 CAs in the AD Forest. The "\CA Name" is more about the name of your PKI Tree and should not be confused with \INST1 type instances seen in MSSQL Configuration, which is what I think you may be thinking of. It would be good practice to keep your CAs separated, because if all ...


0

Also, why don't you take the opportunity to upgrade your environment to the most current Windows version, as this has all changed now. Even with 2012 R2 Standard edition you get all features now, there are no restrictions anymore. The only difference between Standard and Datacenter is that you can run unlimited virtual guests with Datacenter. No feature ...


0

If it weren't for the server running ADCS then I wouldn't be as worried; however here is what I would do: 1) Make sure you have a good backup of the 2008 DC; take one right before the upgrade. 2) Make sure that no FMSOs are owned by the 2008 DC; if there are any that it holds, transfer them to other DCs and give your environment time (or force ...


0

This link describes how to extract more logging from the certificate service. A restart may be required. To enable debug logging for the native Windows CertEnroll client, execute the following command: Certutil –setreg enroll\debug 0xffffffe3 The log file is in the following location: %windir%\CertEnroll.log certutil –setreg ca\debug 0xffffffe3 ...



Top 50 recent answers are included