Background: We have DA, single site config. Enterprise PKI with Offline Root and online Intermediate CA (Intermediate CA used to issue Computer Certs to clients for DA). The Intermediate CA's cert is expiring, and we have issued a new Intermediate Cert. That cert has propagated across the enterprise and is in the trusted intermediate store for all domain joined clients, servers, including DA servers, etc. Both the old and new Intermediate Certs are valid and in clients Intermediate Trusted CA stores.

Problem: Direct Access servers show IPSec error as the configuration still has the old Intermediate CA Certificate in it and needs to be updated.

Question: What is the impact to DA clients once we switch over in that configuration? I understand it will update GPO and clients will get that GPO, but will it immediately break DA clients until they get a GP Update, or will this change not impact client connectivity?

  • Did you ever get this sorted? I’m in an eerily similar situation, last thing I want to do is break remote access for clients! Any guidance/help would be much appreciated. Thanks, Chris – Chris Apr 8 at 22:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.