Re: CA (certificate Authority) - Removing AD from box
- From: Kyle BLake <KyleBLake@xxxxxxxxxxxxxxxxxxxxxxxxx>
- Date: Thu, 7 May 2009 11:19:01 -0700
Thanks for your help guys!
A: This is not the last domain controller in our environment.
A: Yes it is an Enterprise CA
A: Yes it was a DC when it became a "CA"
This link is good to :
http://www.microsoft.com/downloads/thankyou.aspx?familyId=c70bd7cd-9f03-484b-8c4b-279bc29a3413&displayLang=en
I've read those microsoft postings and it sounds like one has to really pay
attention and ensure the plan works out ok. My god this is involved.
Q: If the CA is down can we expect that no one can open an email because
exchange depends on it ?!
Move a CA on a domain controller to a CA on a different computer (migrating
a CA)
• CA backup
• CA configuration backup
• Uninstall services
• Install CA
• CA restore
• Active Directory cleanup
"Paul Bergson [MVP-DS]" wrote:
I would move the ca to another server, the name has to be the same to not.
break the trust. I also would recommend you repost this question in the
security NewsGroup.
HOWTO: Move a certificate authority to a new server running on a domain
controller
http://support.microsoft.com/default.aspx/kb/555012/en-us
How to move a certification authority to another server
http://support.microsoft.com/default.aspx?scid=kb;en-us;298138#toc
Security NewsGroup
microsoft.public.security
--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
http://www.pbbergs.com
Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.
"Kyle BLake" <KyleBLake@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:9EAC6393-E4CC-457F-8FE3-D45C4280217D@xxxxxxxxxxxxxxxx
Hi,
I have a win2kr2 DC that has CA installed. Is it ok to demote the machine
and will CA still run?
Where does the "CA" information reside, in "AD"?
I am going to virtualize this hardware as it's quite old thus the machine
name will stay the same. Very important I understand to keep name the
same.
Does anyone see any problems demoting the DC to a member server and then
migrating it? I don't think CA depends on the nic MAC or anything our
rageous like that, right?
- References:
- CA (certificate Authority) - Removing AD from box
- From: Kyle BLake
- Re: CA (certificate Authority) - Removing AD from box
- From: Paul Bergson [MVP-DS]
- CA (certificate Authority) - Removing AD from box
- Prev by Date: Re: dsrm tool
- Next by Date: Re: Allow simple password for a paticular user
- Previous by thread: Re: CA (certificate Authority) - Removing AD from box
- Next by thread: dsrm tool
- Index(es):
Relevant Pages
|
