Hi all, I've a Windows 2003 domain. All the DC are Windows Server 2003 R2. I have to upgrade di AD to Windows Server 2008 R2. One "old" domain controller has an Enterprise Root CA that issues certificate for the IAS servers. I don't want to upgrade in place that "old" DC I prefer to build brand new server with Windows Server 2008 R2. I want to move my CA to a different server, with different name. I know that there is a "bloody" procedure to migrate the CA. What happens if I decommission my CA and I create a brand new one with the same "certificate templates"? What happens to my IAS servers when their certificates expire?

The best place to ask in Security Forum. Thanks

ok, just do it

Hi, To avoid any confusion, please focus on another thread: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/f5e7a405-d386-42ec-b6ab-3ce1f2350dfe Regards, Bruce

Hello, to upgrade to AD DS 2008 R2: http://technet.microsoft.com/en-us/library/cc731188(WS.10).aspx One "old" domain controller has an Enterprise Root CA that issues certificate for the IAS servers. If you are planning to demote it then you have to migrate your CA and then uninstall your old CA. See that: http://support.microsoft.com/kb/298138 http://technet.microsoft.com/en-us/library/ee126140(WS.10).aspx This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner 2010 / 2011 Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows 7, Configuring Microsoft Certified IT Professional: Enterprise Administrator Microsoft Certified IT Professional: Server Administrator Microsoft Certified Trainer

Hi, To avoid any confusion, please focus on another thread: http://social.technet.microsoft.com/Forums/en-US/winserversecurity/thread/f5e7a405-d386-42ec-b6ab-3ce1f2350dfe Regards, Bruce