1. Back-Out Procedure
In case of migration failure i.e. if the Certificate authority service fails to stop, auto enrollment failure or error/issue in any of the verifying migration steps. Then the back-out procedure has to be executed to restore the CA service on the source server.
a. Removing CA Role from Destination server
Log on to the destination server, and start Server Manager.
In the console tree, click Roles.
On the Roles pane click, Remove Roles
If the Before you begin page appears click Next
On the Remove Server Roles, Uncheck ACTIVE Directory Certificate Services and click Next
Click Remove on the Confirm Removal Selection and restart the server once completes
Remove Destination server from domain
Rename the Destination server
b. Adding CA Role on Source Server
Rename the source server to the initial name
Add the source server to domain
Launch Add or Remove programs and select add/remove windows components and select Certificate Service and click, Next
Select Enterprise Subordinate CA as CA Type and select “Use custom settings to generate the key pair and CA Certificate”
On the Public and Private Key Pair click Import and select the backed up file .p12 and enter the password and click next
Click Next to proceed with the CA configuration and close
c. Restoring CA DB on source server
Launch Certificate Authority snap in
Select CA node and click on Actions, All Task and Restore CA
On the Items to Restore select Private key and CA Certificate and Certificate Database and Certificate Database Log
Browse the CA DB Location and Click Next
Enter the password set while backing up the CA
d. Restore Certificate template list
Open a command prompt window.
Type certutil -setcatemplates +<templatelist1>,<templatelist2>.. and press ENTER.
Hope this article was informative and helpful to you . This is based on test with real time scenario.
Below are the links of other part of the article
Part 1 – Preparing Source CA and Target server
Part 2 – Restoring the Source from backups and Verifying the migration
Please comment if you like this article 
1. Restore Source CA Server from backup
a. Restore CA DB
Log on to the destination server by using an account that is a CA administrator.
Start the Certification Authority snap-in.
Right-click the node with the CA name, point to All Tasks, and then click Restore CA.
On the Welcome page, click Next.
On the Items to Restore page, select Certificate database and certificate database log.
Click Browse. Navigate to the parent folder that holds the Database folder (the folder that contains the CA database files created during the CA database backup).
Click Next and then click Finish.
b. Restore CA Registry
Create a backup of the current Registry setting
Open the exported registry file from source servers in notepad and verify the registry values
Open a Command Prompt window.
Type reg import <Registry Settings Backup.reg> and press ENTER.
Type net start certsvc and press ENTER.
c. Restore Certificate template list
Open a command prompt window.
Type certutil -setcatemplates +<templatelist1>,<templatelist2>.. and press ENTER.
2. Verifying migration
a. Verify ACL’s on the AIA and CDP Containers
Logging to DC and open Active Directory Sites in Services
On the Console click on Top Node
Click View and Show Services node you will find Services folder on the Left and expand to reach Public key Services
Expand Public Key Services
Click AIA folder and in the details pane, select the name of the source CA.
On the Action menu, click Properties.
Click the Security tab, and then click Add.
Click Object Types, click Computers, and then click OK.
Type the host name of the target CA, and click OK.
In the Allow column, select Full Control, and click OK.
If Account unknown with security identifier exist then select it and remove the object.
In the left pane, select CDP and the host name of the source CA.
In the details pane, select the first CRL object.
On the Action menu, click Properties, and then click the Security tab.
In the list of permitted group or user names, select the name of the source CA, click Remove, and then click Add.
Click Object Types, select Computers, and then click OK.
Type the host name of the target CA, and click OK.
In the Allow column, select Full Control, and then click OK.
If Account unknown with security identifier exist then select it and remove the object.
b. Verify Registry
Verify that CAServerName is a registry string value located under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\CAName\ registry key. It should be updated to represent the DNS or the host of the new CA host.
Verify that CACertPublicationURLs and CRLPublicationURLs are both registry multi-string values located under the same key as CAServerName.
c. Verify Auto Enrollment
Log on to a domain member computer by using an account that has Autoenroll, Enroll, and Read permissions for the certificate templates that are assigned to the destination CA.
Click Start, and then click Run.
Type certmgr.msc, and then click OK to open the Certificates snap-in.
In the console tree, right-click Certificates – Current User, click All Tasks, and then click Automatically Enroll and Retrieve Certificates to start the Certificate Enrollment wizard.
On the Before You Begin page, click Next.
On the Request Certificates page, a list of one or more certificate templates should be displayed. Select the check box next to each certificate template that you want to request, and then click Enroll.
Click Finish to complete the enrollment process.
In the console tree, double-click Personal, and then click Certificates to display a list of installed user certificates and to verify that the certificate that you requested is displayed.
Hope you liked this article and got some good understanding of migration process of CA server windows server 2003 to windows server 2008. Please continue with the last part with the backup process. You should know this part to revert back if necessary.
Below are the links for the other parts
Part 1 – Preparing source and target CA server for migration.
]]>This article is published in three parts and in this part we will discuss more in details on about preparing of source and destination server for the migration
1. Preparing Source Server
Map network share in source server to copy backup files
Perform/Verify System state backup of Source CA
a. Verify and backup CA Template set
Open Command prompt
Type certutil.exe – catemplates > catemplates.txt
Verify the contents of catemplates.txt with the templates displayed in Certificate Authority snap-in
b. Verify and backup CA’s CSP and signature algorithm
Open Command prompt
Type certutil.exe –getreg ca\csp\* > csp.txt
Verify that the csp.txt contains CSP detaill
c. Publish CRL with extended validity period
Open Certificate Authority snap in
In the console tree right click “Revoked Certificates” and click Properties
Record the current CRL Publishing Parameters
Set the CRL Delta publishing interval to 2 days
Click on “Revoked Certificates” -> all task -> publish -> Delta CRL only
d. Backup CA DB and Private Key
Map shared network drive to take the backup
on Certificate authority snap-in right click point to All task and backup CA
On the Welcome page of the CA Backup wizard, click Next.
On the Items to Back Up page, select the Private key and CA certificate and Certificate database and certificate database log check boxes, specify the backup location, and then click Next.
On the Select a Password page, type a password to protect the CA private key, and click Next.
On the Completing the Backup Wizard page, click Finish.
After the backup completes, verify the following files in the location you specified CAName.p12 containing the CA certificate and private key Database folder containing files certbkxp.dat, edb#####.log, and CAName.edb
Open command prompt and type Net stop Certsvc to stop Certificate Service
e. Backup CA Registry
Click Start, point to Run, and type regedit to open the Registry Editor.
In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc, right-click Configuration, and then click Export.
Specify a location and file name, and then click Save. This creates a registry file containing CA configuration data from the source CA.
f. Remove source server
Launch Add or remove program
Click Add/Remove windows components and uncheck Certificate Services
Click next and finish
Remove source server from domain
Delete AD computer object
Rename source server to some temp name
2. Preparing Destination Server
Change destination server name to the initial source server name
Add destination server to domain
Map network share used in taking the backup on source server
a. Import the CA certificate
Start the Certificates snap-in for the local computer account.
In the console tree, double-click Certificates (Local Computer), and click Personal.
On the Action menu, click All Tasks, and then click Import to open the Certificate Import Wizard. Click Next.
Locate the <CAName>.p12 file created by the CA certificate and private key backup on the source CA, and click Open.
Type the password, and click OK.
Click Place all certificates in the following store.
Verify Personal is displayed in Certificate store. If it is not, click Browse, click Personal, and click OK.
b. Add CA and IIS roles on destination server
Log on to the destination server, and start Server Manager.
In the console tree, click Roles.
On the Action menu, click Add Roles.
If the Before you Begin page appears, click Next.
On the Select Server Roles page, select the Active Directory Certificate Services and Web Server (IIS) check box, and click Next.
On the Introduction to AD CS page, click Next.
On the Role Services page, click the Certification Authority check box, and Certification Authority Web Enrollment and click Next.
On the Specify Setup Type page, specify either Enterprise and click Next.
On the Specify CA Type page, select Subordinate CA, and click Next.
On the Set Up Private Key page, select Use existing private key and Select a certificate and use its associated private key.
In the Certificates list, click the imported CA certificate, and then click Next.
On the Configure Certificate Database page, specify the locations for the CA database and log files.
On the Confirm Installation Selections page, review the messages, and then click Install.
Hope you liked this article, please continue with the next part where we will discuss in details of the below
Part 2 – Restoring the Source from backups and Verifying the migration
Part 3 – Back Out procedure
nvspbind is the new tool written for Windows 2008 Hyper V Servers. Its magical tool and can be used for all Windows 2008 Class servers. nvpsbind helps to enable and disable various network settings like Client for Microsoft network,Qos Packet Scheduler, File and Printer sharing for Microsoft network and the rest. It even allows to configure network binding order. If you windows server is configured as cluster and one of the mandatory requirement is to have 2 or more nic cards and it has to be configured correctly and binding order has to be configured right. Public network in the cluster should be on top of the binding order and followed by replication network.
These things can be done manually as well, but why do i have to use this tool ? Simple, If you wanted to do this on one server, i dont recommend this. But if you wanted to configure on 10 servers may be 100 then i would recommed.
You can find copy of the file here..http://code.msdn.microsoft.com/nvspbind/Release/ProjectReleases.aspx?ReleaseId=3837
Below are some nvspbind examples to enable and disable specific network settings
nvspbind -d “Nic Name” ms_tcpip6 (To uncheck IPV 6 on a Specific Network)
nvspbind -e “Nic Name” ms_tcpip6 (To check IPV 6 on a Specific Network)
nvspbind -d “Nic Name” ms_server (To uncheck File and Printer Sharing for Microsoft Networks)
nvspbind -e “Nic Name” ms_server (To check File and Printer Sharing for Microsoft Networks)
Below are some nvspbind examples to Brint specific network binding order on top of the list.
nvspbind /++ “Nic Name ” ms_tcpip
nvspbind /– “Nic Name ” ms_tcpip
This tool is for all people in the world who wanted to make there life easy with automation and automation is my spirit of life
Below is the example to kill process running on the remote computer and you also force to terminate it.
taskkill /s <servername> /f /im Processname*
Below link has detail instruciton on how to use Taskkill.exe with various options
http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/taskkill.mspx
]]>Moving Certificate Server in Simple Steps
- Perform System State backup on Source CA Server
- Backup CA from CA Console
- Backup CA registry Configuration
- Uninstall CA from the Source Server using Add remove programs
- Install the CA as Role on the target Windows 2008 computer using existing certificate key
- Restore the CA database on the target CA
- Import the CA Registry configuration on the target CA
- Complete post-migration tasks
Perform System State backup on Source CA
- Log in to Source server and Take System State backup using Ntbackup to C:\CertBackup
Backup CA from CA Console
- Open the Certification Authority snap-in
- Right-click the node with the CA name, point to All Tasks, and then click Back Up CA.
- On the Welcome page of the CA Backup wizard, click Next. On the Items to Back Up page, select the Private key and CA certificate and Certificate database and certificate database log check boxes, enter the backup location, and then click Next
4. On the Select a Password page, enter a password to protect the CA private key and click Next.
5. On Completing the Backup Wizard page, click Finish.
6. This will create Files in C:\Certbackup
- certbackup.p12
- Database
Backup CA registery Configuration
1. Click Start, point to Run, and type regedit to open the Registry Editor.
2. In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc, right-click Configuration, and then click Export.
3. Enter a location and file name, and then click Save. This creates a .reg file with the registry configuration information for your CA.
UnInstall CA from the Server using Add remove programs
1. Go To Add remove programs -> Add remove Windows components -> click on Certificate Services and uncheck on Certificate Services CA and Certificate Services Web Enrollment Support
Install the CA as Role on the target computer using exisintg certificate key
- Install New Widows 2008 Enterprise Edition Sever
- Open Server Manager and Add New Role
- Select Active Directory Certificate Services
- Select Certificate Authority and Next
- Select Enterprise CA and Next
- Use Existing Private Key as show below and select selct a certificate and user its associated private key and Next
7. Click on Browse buttong to Search folder containing certificate and private key which you exported from Source computer
8. Enter the password which was used to export
9. Next , Next and click on Install
Restore the CA database on the target CA
- Open the Certification Authority snap-in.
- Right-click the node with the CA name, point to All Tasks, and then click Restore CA. Click OK to confirm stopping the CA service.
- In the CA Restore wizard, on the Welcome page, click Next.
- On the Items to Restore page, select Certificate database and certificate database log. Click Browse, and navigate to the location of the Database folder that contains the CA database export files created when you previously exported the CA database.
- Enter the password you used to export the CA database from the source CA, if a password is requested.
- Click Finish, and then click Yes to confirm restarting the CA.
Import the CA Registery configuration on the target CA.
- Double click on registery file which you exported from the source server to import the same into the server and Yes to confirm the same
Complete post-migration tasks
Updating CRL Distribution Point and Authority Information Access Extensions
- Loging to Windows 2008 New CA Server
- Open Certificate MMC
- Right click on the CA and click on Extenstion and click on ADD and add the below line by changing SourceServername.
ldap:///CN=<CATruncatedName><CRLNameSuffix>,CN=SourceServername,CN=CDP,CN=Public Key Services,CN=Services,<ConfigurationContainer><CDPObjectClass>
4. Check Publish CRLs to this location
5. Publish Delta CRLs to this location
6. Apply and OK
7. Verify the CA can publish CRLs to the new location.
8. Open the Certification Authority snap-in.
9. Right-click Revoked Certificates, point to All Tasks, and click Publish.
10. Click either New CRL or Delta CRL only, and click OK.
To verify ACLs on the AIA and CDP containers
- Loging to DC and open Active Direcotry Sites in Services
- On the Console click on Top Node
- Click View and Show Services node
- you will find Services folder on the Left and expand to reach Public key Services as shown below
5. Expand Public Key Services
6. click AIA folder and In the details pane, select the name of the source CA.
7. On the Action menu, click Properties.
8. Click the Security tab, and then click Add.
9. Click Object Types, click Computers, and then click OK.
10. Type the host name of the target CA, and click OK.
11. In the Allow column, select Full Control, and click OK.
12. In the left pane, select CDP and the host name of the source CA.
13. In the details pane, select the first CRL object.
14. On the Action menu, click Properties, and then click the Security tab.
15. In the list of permitted group or user names, select the name of the source CA, click Remove, and then click Add.
16. Click Object Types, select Computers, and then click OK.
17. Type the host name of the target CA, and click OK.
18. In the Allow column, select Full Control, and then click OK.
19. In the details pane, select the next CRL object, and repeat steps 14 through 18 until you have reached the last object.
Verifying ReGistery
1. Verify that CAServerName is a registry string value located under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\CAName\ registry key. It should be updated to represent the DNS or the host of the new CA host.
2. Verify that CACertPublicationURLs and CRLPublicationURLs are both registry multi-string values located under the same key as CAServerName.
3. Check the remaining registry values under the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc registry key, with emphasis on any values that have been customized to ensure that they are free of data containing the old CA host name or other invalid CA settings. For example:
- Configuration\ConfigurationDirectory
- Configuration\CAName\CACertFilename
There lots of advantages in using DFS Replication over FRS to replicate SysVolume. Below link has details description on the DFSR Migration and advantages list over FRS
]]>Please find the copy of the script in the below link
http://powershell.com/cs/members/smtpport25.wordpress/files/PasswordChangeNotification.txt.aspx
]]>
New-ADOrganizationalUnit -Name “OUname” -ProtectedFromAccidentalDeletion $true
This command creates new OU under the root. If we wanted created OU in specific path then we have to provide the pat. Below is the example of the same
New-ADOrganizationalUnit -Name “OUname” -Path “OU=AllUsers,dc=grayson,dc=test” -ProtectedFromAccidentalDeletion $true
-ProtectedformAccidentDeletion $true help to protect the OU getting accidentially deleted.
Get-ADOrganizationalUnit
Helps to get the details of the required OU
Set-ADOrganizationalUnit
Helps to modify the OU
Remove-ADOrganizationalUnit
Helps to remove the required OU
]]>