I'm trying to decommission a Server 2008 machine that hosts DC, NPS, and CA. I've deployed two new servers to take over as root CA and RADIUS server (both new servers are 2012R2). The new root CA is issuing certificates (DC authentication auto-enroll), and the new NPS server has been restored with our existing configuration.

Since I'm moving the NPS server off of a DC, I need to issue it a RAS and IAS Server cert from my new CA. When I try to select the certificate that I created to issue, the interface is only listing certificate templates with a schema version of 1 as available to issue. Is this due to my domain functional level (2008)? Or the fact that I still have an authorized CA running Server 2008 standard? Or am I missing something else?


EDIT 1: For my purposes, it turns out that a regular old Computer cert allows RADIUS to authenticate. I'd still like to figure out why I cannot issue schema version 2/3 cert templates in this configuration.

EDIT 2: I have removed all certificate templates from the Server 2008 CA. When I manage templates from the 2012R2 CA, I can see the V2&3 certificates, but when I enter "Certificate Template to Issue" screen, only V1 templates are listed.

EDIT 3: Template example:

  • Duplicate Computer template (Creates a version 2 template)
  • General: Change display name, check Publish certificate in Active Directory
  • Security: Confirm Authenticated Users have Read, all other permissions Default
  • All other settings default
  1. if existing CA server (2008-based) is not yet decommissioned, you need to remove all certificate templates from this CA.
  2. add desired templates to new CA (2012R2-based) for issuance.

No, there is no dependency on domain functional level.

  • I have an existing Server 2008 CA with no issuing certificate templates. My Server 2012R2 CA has all of the default certificate templates issuing, but will not list V2/3 certificates within the "New -> Certificate Template to Issue" screen. I can see them when I manage templates, and can create/duplicate templates... Just can't select them to issue. – Jaxaeon Oct 28 '14 at 22:05
  • I think I did not allow enough time for replication. Marking as answered. – Jaxaeon Oct 28 '14 at 22:39
  • @Jaxaeon, I've this exact issue. How long took the replication? Thanks! – curropar Jul 5 '16 at 9:35
  • @curropar, Depends on your AD topology. Probably no more than a few hours worst case? – Jaxaeon Jul 6 '16 at 20:21
  • This definitely not my case then: 3 DCs, one site, should not take more than 1 hour. Thanks again thought. – curropar Jul 6 '16 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.