We moved from a SBS 2003 Server to a SBS 2008 server relatively recently because the SBS 2003 was having major hardware issues. I followed the Migration guide to the letter and everything seemed to go smooth. Until after this last update. I noticed that AD Certificate service was not started... I started it and it stopped immediately. So I went to Certification Authority MMC and tried to start the service from there and got the following:

Error 0xxc8000147 (ESE: -327)

So went to the error log and here the associated log:

Log Name: Application Source:

Date: 5/23/2011 7:29:42 AM

Event ID: 17

Task Category: None

Level: Error

Keywords: Classic


Computer: *********.**********.lan

Description: Active Directory Certificate Services did not start: Unable to initialize the database connection for **********-*********-CA. Error 0xc8000147 (ESE: -327).

Event Xml:

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    <Provider Name="Microsoft-Windows-CertificationAuthority" 
        EventSourceName="CertSvc" />
    <EventID Qualifiers="49754">17</EventID> 
    <TimeCreated SystemTime="2011-05-23T14:29:42.000Z" />
    <Correlation />

    <Execution ProcessID="0" ThreadID="0" />
    <Security UserID="*****" />   
  <EventData Name="MSG_E_DB_INIT_FAILED">
    <Data Name="CACommonName">*********-*********-CA</Data>
    <Data Name="ErrorCode">Error 0xc8000147 (ESE: -327)</Data>   

I have been searching for solutions to this issue and really haven't found anything related to the error code for CA services.

  • try running the command "dcdiag" on the new server to see if it leads you in a better direction of getting a usable error message. I think that Microsoft offers free migration customer support. – Nixphoe May 23 '11 at 15:42
  • running dcdiag it passed all tests – user76534 May 23 '11 at 22:16

I recommend removing and reinstalling the Certificate Authority role. This is expressly supported by MS and they even provide an SBS2008 HOWTO here.


eseutil worked for me after I accidently deleted everything in CertLog rather than just the log files.

With the AD Certificate service still stopped, I copied back the edb and jrs files, then ran eseutil /p on the edb (note without the logs) and it repaired the database.

I then started AD Certificate services without a problem.


esentutl /p - repairs the database. It will warn your that any transaction log data will be lost.

I did not have a choice, and this was the only function that worked for me.

cd \windows\system32\certlog

esentutl /p "sbs2008-ca.edb"


repadmin /syncall
  • 2
    To make this a useful answer, please add an explanation what this does and how it helps to solve the OPs problem. – Sven Dec 31 '14 at 17:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.