AD CA

[timbo343]

This summer im in the process of hopefully moving all 2008 Domain controllers. I have come to one of the DCs and found it has the AD CA role installed on it. Ive never used this role and looking in the service I see noting in resolved, nothing in issued, a whole load of pending requests from other DCs and a fair few failed requests.

 

Quick and dumb question, do I need this role migrating to a 2012r2 server or can it be removed and where/when would I use this role?

[win]

it sounds like you need to backup the CA DB and then re-add it to the new 2012r2 server when built:

 

https://technet.microsoft.com/en-us/library/ee126140(v=ws.10).aspx

[3s-gtech]

We had a CA role on one of our DCs - I migrated it across to its own VM to make it more flexible. I update DCs fairly often, and re-doing CAs at the same time would be a pain.

[Sagima]

I had something similar when I started here - a 2003 DC with the CA role. It had issued all of two certificates so I just got rid of it in the summer and created another CA. It didn't affect anything. I barely use the CA I have now - it has issued a certificate to each of my three domain controllers - I imagine were I to bin this one I could just get a new one to do the same.

[plexer]

If you are not actively using it I would take it as the opportunity to can it and move it to it's own server if you are going to be using cert services in the future.

 

Ben

[Blue_Cookeh]

Can it if it hasn't issued anything.

 

If you need a local CA, do it properly with an offline root etc. You might find having one is beneficial later on down the line, we use ours for auto enrolment on our domain computers so that can communicate with SCCM more securely, and automatically trust our SSL inspection proxy.

[jmak]

I found that having a local CA can be useful if you want to try and decrypt user's data after you've deleted their AD User...

 

Unfortunately I didn't find this until after it transpired that I didn't have a GPO to prevent users from encrypting folders

 

I would be interested to hear what the reasons for not having the CA role installed, as I now have it running.

[Blue_Cookeh]

I would be interested to hear what the reasons for not having the CA role installed, as I now have it running.

 

Generally you'd want to plan a CA deployment before installing the role so that you maintain full control over any of the certificates it gives out, hence why keeping your root CA offline is generally a good thing!

[plexer]

Configuring an offline Root CA with 2 tier PKI hierarchy - Ricky in Melbourne Ricky in Melbourne

 

Just because you can add a role to a domain controller doesn't mean you should.

 

Ben

[jmak]

Generally you'd want to plan a CA deployment before installing the role so that you maintain full control over any of the certificates it gives out, hence why keeping your root CA offline is generally a good thing!

 

Thanks for the advice - I'll have a more in depth read now that I'm not in panic mode! (Which I know is generally not the best time to make changes, but I can't be the only one....)

 

Just because you can * doesn't mean you should.

 

Ben

 

With the "add a role to a domain controller" removed this is remarkably good life advice