I'm new to windows CA. I can not find a "best practice" recommendation for initially configuring crloverlapunits and crldeltaoverlapunits. Can anybody provide some guidance on this? Thanks.

You should set reasonable overlap settings if you have file publishing/replication delays. For offline CAs it is reasonable to set overlap to 1 week or so. For online CAs the value should be less and should not exceed Delta CRL validity period. Typically overlap value should be 1-several hours for online CAs.My weblog: http://en-us.sysadmins.lv PowerShell PKI Module: http://pspki.codeplex.com