KB 889250 is just fine but I will stop at step 6 and keep all trusts an certificates in the enterprise stores until the removal/replacement of all issued certificates has been completed. /Hasain

Hi, I would suggest : - Make full /image backup. - I would personally export the Root CA with private key. - remove the CA. There soudn't be any risk for Ad if Ca wasn't used heavily . Best Regards, Spas Kaloferov [ MCITP: SA6 | EA6 | VA7 | EDA7 |DBA10 | DBD10 | BID10 | EMA14 | SPA14 ] NetShell Services & Solutions | “Design the future with simplicity and elegance” Visit me at: www.spaskaloferov.com | www: www.netshell-solutions.com This posting is provided "AS IS" with no warranties or guarantees, and confers no rights.

I'm currently undertaking a Windows 2008R2 domain upgrade project and need some advice regarding the removal of the only Enterprise CA installed in the environment. The client several years ago had installed Enterprise CA on a domain controller in the environment to issue a single EFS cert which has long since expired and was never used. The only Issued Certificates that are still active are for the 3 DC's in the environment (all other issued certs are long since expired). My understanding is that the DC's will automatically request certificates from an Enterprise CA if one exits. As the client has no need/nor will they likely ever have a need for an Enterprise CA I simply wanting to remove this service in the fastest/least risk manner possible. I am going to follow http://support.microsoft.com/kb/889250 but wanted to know if there was a better way or if there may be some possible risk to AD.

KB 889250 is just fine but I will stop at step 6 and keep all trusts an certificates in the enterprise stores until the removal/replacement of all issued certificates has been completed. /Hasain