{"id":10365,"date":"2014-11-10T08:10:42","date_gmt":"2014-11-10T07:10:42","guid":{"rendered":"http:\/\/nolabnoparty.com\/?p=10365"},"modified":"2014-11-10T08:13:23","modified_gmt":"2014-11-10T07:13:23","slug":"remove-ca-active-directory","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/remove-ca-active-directory\/","title":{"rendered":"Remove CA from Active Directory"},"content":{"rendered":"

\"decommissionca01\"<\/p>\n

To remove Certification Authority from Active Directory you must follow\u00a0the correct steps in order to delete\u00a0the CA objects and services no longer needed.<\/p>\n

The procedure helps to properly decommission the CA and clean the Active Directory environment from the objects left during the uninstall process of the AD Certificate Services.<\/p>\n

 <\/p>\n

Revoke all issued certificates<\/h2>\n

Open the Certification Authority, expand the configured CA and navigate to Issued Certificates<\/strong>. In the right pane right click the issued certificates and select All Tasks > Revoke Certificate<\/strong> option.<\/p>\n

\"decommissionca02\"<\/p>\n

Specify a reason in the Reason code<\/strong> field then click Yes<\/strong>.<\/p>\n

\"decommissionca03\"<\/p>\n

The certificate is removed from the list.<\/p>\n

\"decommissionca04\"<\/p>\n

Right click the Revoke Certificates<\/strong> item and select Properties<\/strong>.<\/p>\n

\"decommissionca05\"<\/p>\n

Increase the CRL publication interval<\/strong> by typing a suitably long value then click OK<\/strong>.<\/p>\n

\"decommissionca06\"<\/p>\n

Now right click Revoked Certificates<\/strong> item and select All Tasks > Publish<\/strong>.<\/p>\n

\"decommissionca07\"<\/p>\n

Select New CRL<\/strong> option and click OK<\/strong>.<\/p>\n

\"decommissionca08\"<\/p>\n

In the Pending Requests<\/strong> folder deny any pending certificate requests right clicking the pending request then selecting All Tasks > Deny Request<\/strong>.<\/p>\n

\"decommissionca09\"<\/p>\n

 <\/p>\n

Uninstall AD Certificate Services<\/h2>\n

From the server, open the Command Prompt<\/strong> and type the command:<\/p>\n

C:\\>certutil -shutdown<\/pre>\n
\"decommissionca10\"<\/p>\n
To list all key stores<\/strong> for the local computer, type in the Command Prompt:<\/p>\n
C:\\>certutil -key<\/pre>\n
\"decommissionca11\"<\/p>\n
Delete the private key<\/strong> associated with the CA using the command:<\/p>\n
certutil -delkey CertificateAuthorityName<\/p><\/blockquote>\n
C:\\>certutil \u2013delkey le-DomainController-b48c7ee1-d400-4b69-af19-6810bf38d263<\/pre>\n
\"decommissionca12\"<\/p>\n
List the key stores once again to check if the CA private key has been removed<\/strong>.<\/p>\n
C:\\>certutil -key<\/pre>\n
\"decommissionca13\"<\/p>\n
Open the Server Manager, select Roles<\/strong> item and click Remove Roles<\/strong> in the right pane.<\/p>\n
\"decommissionca14\"<\/p>\n
The Remove Roles Wizard opens. Click Next<\/strong> to continue.<\/p>\n
\"decommissionca15\"<\/p>\n
Uncheck Active Directory Certificate Services<\/strong> then click Next<\/strong>.<\/p>\n
\"decommissionca16\"<\/p>\n
Click Remove<\/strong> to proceed.<\/p>\n
\"decommissionca17\"<\/p>\n
The selected role is being removed.<\/p>\n
\"decommissionca18\"<\/p>\n
Click Close<\/strong> to exit the wizard.<\/p>\n
\"decommissionca19\"<\/p>\n
Click Yes<\/strong> to restart the server.<\/p>\n
\"decommissionca20\"<\/p>\n
After rebooting the server, the procedure is complete.<\/p>\n
\"decommissionca21\"<\/p>\n
 <\/p>\n
Remove CA objects from Active Directory<\/h2>\n
When the CA is installed, several objects are created in the Active Directory but not removed during the uninstalling process. Only pKIEnrollmentService<\/strong> object is removed to prevent clients from trying enroll against the decommissioned CA.<\/p>\n
Open the Command Prompt and type the command certutil<\/strong>.<\/p>\n
C:\\>certutil<\/pre>\n
\"decommissionca22\"<\/p>\n
Open the Active Directory Site and Services<\/strong> and select View >Show Services Node<\/strong>.<\/p>\n
\"decommissionca23\"<\/p>\n
Navigate to Services > Public Key Services > AIA<\/strong>. Right click the CA object and select Delete<\/strong>.<\/p>\n
\"decommissionca24\"<\/p>\n
Click Yes<\/strong> to confirm deletion.<\/p>\n
\"decommissionca25\"<\/p>\n
Now navigate to Services > Public Key Services > CDP<\/strong>. Right click the container object where Certificate Services is installed and select Delete<\/strong>.<\/p>\n
\"decommissionca26\"<\/p>\n
Click Yes<\/strong> to confirm deletion.<\/p>\n
\"decommissionca27\"<\/p>\n
Click Yes<\/strong> to confirm.<\/p>\n
\"decommissionca28\"<\/p>\n
Navigate to Services > Public Key Services > Certification Authorities<\/strong>. Right click the CA object and select Delete<\/strong>.<\/p>\n
\"decommissionca29\"<\/p>\n
Click Yes<\/strong> to confirm deletion.<\/p>\n
\"decommissionca30\"<\/p>\n
Navigate to Services > Public Key Services > Enrollment Services<\/strong>. In the right pane verify that the pKIEnrollmentService object has been removed during the CA uninstall process. If the object is not deleted, right click the object, select Delete<\/strong> and click Yes<\/strong> to confirm.<\/p>\n
\"decommissionca31\"<\/p>\n
Navigate to Services > Public Key Services > Certificate Templates<\/strong>. In the right pane select a certificate and press CTRL+A<\/strong> to select all templates. Right click and select Delete<\/strong>.<\/p>\n
\"decommissionca32\"<\/p>\n
Click Yes<\/strong> to confirm deletion.<\/p>\n
\"decommissionca33\"<\/p>\n
 <\/p>\n
Delete certificates published to the NtAuthCertificates object<\/h2>\n
When CA objects are deleted, also the CA certificates published to the NtAuthCertificates<\/strong> object have to be deleted.<\/p>\n
With Enterprise Administrator<\/strong> permissions, check the full LDAP path to the NtAuthCertificates object in Active Directory with the following command:<\/p>\n
C:\\>certutil -store -? | findstr \"CN=NTAuth\"<\/pre>\n
\"decommissionca34\"<\/p>\n
To delete certificates from within the NTAuthCertificates store, run the command:<\/p>\n
C:\\>certutil \u2013viewdelstore \u201cldap:\/\/\/CN=NtAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=nolabnoparty,DC=local?cACertificate?base?objectclass=certificationAuthority\u201d<\/pre>\n
\"decommissionca36\"<\/p>\n
Click OK<\/strong> to delete the certificate.<\/p>\n
\"decommissionca37\"<\/p>\n
Now run the following command:<\/p>\n
C:\\>certutil \u2013viewdelstore \u201cldap:\/\/\/CN=NtAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=nolabnoparty,DC=local?cACertificate?base?objectclass=pKIEnrollmentService\u201d<\/pre>\n
\"decommissionca38\"<\/p>\n
Click OK<\/strong> to delete the certificate.<\/p>\n
\"decommissionca39\"<\/p>\n
 <\/p>\n
Delete the CA database<\/h2>\n
Since the database is not removed during the Certification Services uninstall process, to remove the database delete the %systemroot%\\System32\\Certlog<\/strong> folder.<\/p>\n
\"decommissionca40\"<\/p>\n
 <\/p>\n
Remove certificates from DCs<\/h2>\n
Also the certificates that were issued to Domain Controllers must be removed.<\/p>\n
On a Domain Controller<\/strong>, open the Command Prompt and type the command:<\/p>\n
C:\\>certutil -dcinfo deleteBad<\/pre>\n
\"decommissionca41\"<\/p>\n
Certutil tries to validate all the DC certificates<\/strong> that are issued to the domain controllers. Certificates that do not validate are removed. The Active Directory Certificate Services<\/strong> has been removed from the Active Directory successfully.<\/p>\n
\"firma\"<\/p>\n","protected":false},"excerpt":{"rendered":"
To remove Certification Authority from Active Directory you must follow\u00a0the correct steps in order to delete\u00a0the CA objects and services no longer needed. The procedure helps to properly decommission the CA and clean the Active Directory environment from the objects left during the uninstall process of the AD Certificate Services.<\/p>\n","protected":false},"author":3,"featured_media":10325,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[913,1065],"tags":[1250,1096,1251,1252],"class_list":["post-10365","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-active-directory-en","category-microsoft-en","tag-active-directory-en-7","tag-certification-authority","tag-decommission-en-5","tag-remove-en-5","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/10365","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=10365"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/10365\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/10325"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=10365"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=10365"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=10365"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}