Are there any differences stopping the CA using: net stop certsvc or certutil -shutdown

Generally no. First method uses service management APIs and seond itilizes these APIs over DCOM connection (for details see MS-CSRA protocol specifications). While 'net start' and 'net stop' can be used only locally, a DCOM allows you to shut down a services on a remote computer.My weblog: http://en-us.sysadmins.lv PowerShell PKI Module: http://pspki.codeplex.com Windows PKI reference: on TechNet wiki