2

We started getting event ID 13 from a our domain controllers:

Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from OLDSERVER.domain.local\oldserver (The RPC server is unavailable. 0x800706ba (WIN32: 1722)).

OLDSERVER was a 2003 domain controller and certificate services server that was removed from the domain at least a couple of years ago. All our current DC's are 2008 R2 and the functional level was raised to that as well.

Where can I begin to change which CA is registered for this auto enrollment?

1
  • 2
    Find the group policy referencing the old server? If there are none, then create a new policy that will apply to the new server?
    – Zoredache
    Dec 12, 2013 at 22:36

1 Answer 1

3

First off, remove the old CA from being registered in AD - use the Enterprise PKI snap-in to remove every trace of the old CA from the AD Containers, see here.

manage ad containers

Next, make sure you have an enterprise CA that's configured to issue that certificate template (or move the autoenroll setting to a more modern template for your DCs like Kerberos Authentication).

Then, force a re-enroll on the certificate template, so your DCs will enroll a fresh cert instead of trying to renew against a long-dead CA. Make sure everything connecting to the DCs trusts the new CA before you do this.

reenroll

6
  • I think this is exactly what I needed. The old server was everywhere in there. Should the new CA show up eventually in Manage AD Containers?
    – Tamerz
    Dec 13, 2013 at 16:11
  • Hmm. It should be there immediately, as soon as it's set up. Was it by chance built as a Standalone CA instead of an Enterprise CA? Dec 13, 2013 at 16:24
  • Yes, the new CA is a standalone CA. I'm assuming in that case it is normal for that to be empty?
    – Tamerz
    Dec 13, 2013 at 16:49
  • @Tamerz Right - to have the CA integrated with the domain and to let the users and computers (including the domain controllers) automatically enroll for certificates, it will need to be an Enterprise CA. You could build an Enterprise CA that's a subordinate CA to the Standalone? Dec 13, 2013 at 17:37
  • 1
    @ShaneMadden what If one doesn't have a new enterprise CA and no intention to running one? E.g. just remove DCs from auto-enroll and have them use self-signed certificates as in an environment without a CA?
    – omni
    Nov 1, 2017 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .