Revisions to How to Properly Migrate Active Directory Certificate Services

deleted 40 characters in body

edited Feb 3, 2022 at 22:05

73.1k
60
217
340

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate and the same CA settings.
Restore the CA backup on the new server.

Of course, there are several additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus:

Perform CA backup
Remove AD CS
Demote server
Remove (or rename) server
Add new server with same name
Install AD CS
Restore CA backup

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate and the same CA settings.
Restore the CA backup on the new server.

Of course, there are several additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus:

Perform CA backup
Remove AD CS
Demote server
Remove (or rename) server
Add new server with same name
Install AD CS
Restore CA backup

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate and the same CA settings.
Restore the CA backup on the new server.

Of course, there are several additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus:

Perform CA backup
Remove AD CS
Demote server
Remove (or rename) server
Add new server with same name
Install AD CS
Restore CA backup

added 416 characters in body

Source Link

edited Feb 3, 2022 at 21:46

Massimo

73.1k
60
217
340

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate and the same CA settings.
Restore the CA backup on the new server.

Of course, there are a lot ofseveral additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus:

Perform CA backup
Remove AD CS
Demote server
Remove (or rename) server
Add new server with same name
Install AD CS
Restore CA backup

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate.
Restore the CA backup on the new server.

Of course, there are a lot of additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus:

Perform CA backup
Remove AD CS
Demote server
Remove (or rename) server
Add new server with same name
Install AD CS
Restore CA backup

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate and the same CA settings.
Restore the CA backup on the new server.

Of course, there are several additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus:

Perform CA backup
Remove AD CS
Demote server
Remove (or rename) server
Add new server with same name
Install AD CS
Restore CA backup

added 416 characters in body

Source Link

edited Feb 3, 2022 at 21:40

Massimo

73.1k
60
217
340

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate.
Restore the CA backup on the new server.

Of course, there are a lot of additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus:

Perform CA backup

Remove AD CS

Demote server

Remove (or rename) server

Add new server with same name

Install AD CS

Restore CA backup

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate.
Restore the CA backup on the new server.

Of course, there are a lot of additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

> the 2019 server having a different host name assigned shouldn't be an issue, correct?

Unfortunately it's not correct at all.
Moving a Certification Authority to a new server with the same name is a quite straightforward process, but it gets a lot more difficult (in some cases bordering on impossible) if the new server has a different name.

Also, hosting a Certification Authority on a Domain Controller is definitely not recommended, last but not least because you can't promote, demote or rename a server which is hosting a CA; you really should take this opportunity to separate the two roles on two different servers.

How to do this the proper way:

Install a new server with a new name and join it to the domain.
Promote the new server to Domain Controller; make sure to install DNS and to make it a Global Catalog.
Perform a CA backup of your Certification Authority, including the root certificate.
Remove AD CS from the old server.
Move all FSMO roles to the new server.
Configure both servers and all domain member computers to use the new server as their primary DNS (or swap the two servers' IP addresses).
Demote the old server.
Remove the old server form the domain (or, if you need to keep it around for a while, rename it in order to free up its name).
Install an additional new server with the same name as the old one; join it to the domain.
Install AD CS on the new server using the existing root certificate.
Restore the CA backup on the new server.

Of course, there are a lot of additional details; but this is the full outline of the process.

Oh, and don't forget to add another Domain Controller. You really should not have only one of them.

Re-reading your question, it's not really clear how many Domain Controllers you have; if you already have more than one of them, this will make things a bit easier. But you'll still have to recycle the server name, and you can't demote or rename a server as long as it's hosting a CA; thus: