I'm currently facing an issue with a domain's Certificate Authority (CA) that was set up on a domain controller (DC). Due to some recent updates, specifically a SentinelOne update, a number of virtual machines on one of our HyperV hosts crashed, including the DC that holds the CA role. After restoring the DC from backup, I've encountered replication issues within Active Directory because it isn't functioning properly now. The DC also manages DNS.
I'm considering the following steps to remedy the situation, but I want to make sure it's feasible:
1) Backup the CA (including certificates, keys, and config) and determine how to verify that the backup is valid.
2) Remove the CA role.
3) Demote the DC.
4) Import the backup on a separate server (that's domain joined but not a DC), using the same CA name.
5) Finally, promote that server back to DC.
Will these steps work? And will all existing certificates as well as the subordinate CA continue to function properly after this process?
3 Answers
If that DC happens to be a Primary Domain Controller (PDC), it might be beneficial to set up another DC and move the FSMO roles over. This way, you can safely demote the old DC or address the CA issue without additional complications. Just to confirm, is that CA on the DC your root CA?
Have you tried just demoting the DC and then removing the Active Directory services while retaining the CA? It might be worth testing this out on a clone outside of your network before taking any drastic steps. Just keep in mind that if you have the CA role still in place, it seems like you can’t demote it.
So, while I’m no Windows PKI expert, historically moving a PKI is tricky—you usually have to start fresh. Best practice suggests that your root CA should ideally be offline most of the time, allowing you to focus just on your issuing CA. If I were in your shoes, I'd consider starting from scratch with a new root CA server, but I'm aware that all the current devices still depend on certificates from the existing CA.
Related Questions
Can't Load PhpMyadmin On After Server Update
Redirect www to non-www in Apache Conf
How To Check If Your SSL Cert Is SHA 1
Windows TrackPad Gestures