I recently decommissinoed a Root CA to install a fresh Root CA and I followed everything from this guide: http://support.microsoft.com/kb/889250. Except, I also deleted the OIDs. I figured it would re-create itself if it was really needed the next time I installed the AD CS role. Now when I install a Root CA on my DC, I get errors, and the service doesn't start. Whenever I try to manually start the service, it says, "Cannot complete this function." I found this post http://blogs.technet.com/b/askds/archive/2009/03/05/successful-errors-installing-windows-server-2008-certificate-authority.aspx and tried installing/uninstalling AD CS multiple times, still no luck. Domain Admins and Enterprise Admins have Full Control on Public Key Services and child containers inherit permissions from it. How can I install a working/clean Root CA without having to format and re-install Windows Server 2008?