In windows server 2003, we had set up a CA and now it is gone and se are no longer using it. There is a certificate in everyone's internet explorer that has already expired. I don't think it's hurting anything by being there, but is there any way to set up something in a GPO to get rid of it? It seems as if the certificate is showing up on new XP clients, as if a GPO is issuing it, but I can't seem to find the GPO that's issuing it. Any suggestions would be sincerely appreciated. Thanks - Flux

It may be published in the Public Key Services container in the Configuration naming context. Best way to get rid of it is to use the PKIView.msc console and view the AD containers. For details on cleaning up AD, see http://support.microsoft.com/kb/889250 Brian