Migrating 2003 certificate services to 2012

What is the best way to migrate from a 2003 certificate services to a 2012 version? We have run into the issue with not being able to produce a SHA256 template in 2003. Is there a way to bring a 2012 subordinate into the infrastructure to issue the
SHA2 template?
What we were thinking:
1) Bring up a 2012 root CA
2) Bring up the subordinate 2012 CA's
3) Begin issuing from the 2012 infrastructure. Require the users to replace the 2003 certs on the 2012 infrastructure or let them expire. Or is there a way to migrate the 2003 certs over to the 2012 infrastructure? Pointing the 2003 subordinates
to the 2012 root?
DC's are 2008 R2
Thanks in advance. New to the Microsoft CA services and now thrown in to get things working.

Travis,
Here areActive
Directory Certificate Services Migration Guide
General Information for you on the
CA service.
This should get you moving in the right direction.
Cheers,
Curt Winter
Certified Microsoft Professional
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied. If you found my post helpful, please mark it as the answer.

Similar Messages

Windows Server 2003 Certificate Services

When trying to launch Certificate Services (via Start-Programs-Administrative Tools-Certification Authority, mmc, add snap-in, etc.) I'm getting the following error:
Cannot manage Certificate Services. The specified service does not exist as an installed service. 0x424 (WIN32: 1060)
I am a member of the 'Administrators' group on the server. I also tried running mmc in system32 and SysWOW64.
Any help would be appreciated!
Thanks,
Tim

You are not on a computer where AD Certificate Services is installed. You must right-click Certification Authority, and then redirect input to a computer that is actually running certificate services.
By default, the MMC binds to the local computer (hence the error message)
Brian

Migrating Certificate Services to Server 2012 in a 2008 R2 AD Domain

We have a Windows 2008 R2 SP1 Active Directory domain. Our Enterprise Certificate server is running on Windows 2003 R2. We'd like to introduce a Windows 2012 server into our existing domain and migrate the Certificate Services to that new box. Are there
any 'gotchas' to implementing Certificate Cervices on a Windows Server 2012 system in a Windows 2008 R2 SP1 domain that we should be concerned with?
Orange County District Attorney

Hi,
You can migrate Certificate Services to another server but server name should be same. Also changing the server name which has CA role installed is not recommended.
AD CS Migration: Preparing to Migrate
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012
http://technet.microsoft.com/en-us/library/ee126102(v=ws.10).aspx
Also I would request to post this question in security forum :
http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threads
Also you consider, Windows Server 2012 General forum :
http://social.technet.microsoft.com/Forums/en-US/winserver8gen/thread
Best regards,
Abhijit Waikar.
MCSA | MCSA:Messaging | MCITP:SA | MCC:2012
Blog: http://abhijitw.wordpress.com
Disclaimer: This posting is provided "AS IS" with no warranties or guarantees and confers no rights.

Migration of Windows Small Business Server 2003 to Windows Server 2012 Essentials

Hi,
I am trying to migrate Windows Small Business Server 2003 to Windows Server 2012 Essentials by following the steps given in the link below:
http://technet.microsoft.com/en-us/library/jj200112.aspx
I have looked at other threads on the forum but none of them have been too helpful.
The issue: When
I run the Migration Preparation Tool on the Source Server, it runs successfully and does not report any errors. However, when I try installing Windows Server 2012 Essentials on the Destination Server, it displays an error that says 'Source
Server not prepared for migration: After you run the Migration Preparation Tool successfully on your source Server, click retry'.
The Source Server has 2 network adapters-one for the local network and the other for connection to the internet and the router is set as the default gateway this adapter.
Since it is mentioned in the documentation - 'configure your Source Server to use one network adapter', I'm wondering if this is the issue and I need to make changes in this configuration?
On running the Microsoft IT Environment Health Scanner tool it
reported an error - 'DNS Server listening on multiple addresses' and a warning ‘Domain Controller listening on multiple addresses’. Both point to the same solution KB 272294 (http://support.microsoft.com/kb/272294).
But it did not remove the errors.
Other steps performed:
As per the steps, I performed a backup, installed recent service packs and synchronized the source server time with external source.
On running the Best Practices Analyser. It shows 3 warnings.
- The threshold for the Allocated Memory alert is set to the default value. However the server has more than 2 GB of RAM installed.
- Microsoft Outlook Client not installed" Text="Microsoft Outlook Client is not installed in the ClientApps folder. You must run Windows SBS integrated setup.
- The MSFW instance should use the latest available service pack for Microsoft SQL Server 2000. The MSFW instance should use the latest available service pack for Microsoft SQL Server 2000.
I also ran the Ran netdiag.exe, dcdiag.exe commands
and no failures were reported.
The Event Viewer does not show any errors.
Not sure to what extent these warnings would affect the migration.
Any help would be appreciated. Thanks!

The SBS2003 needs to use one NIC only so you'll need to change that before starting. If it is the premium version and has ISA server installed, that will need to be removed first. See:
http://blogs.technet.com/b/sbs/archive/2011/07/01/sbs-2011-standard-migrations-keys-to-success.aspx
-- Al

Best order for migrating 2003 to 2012 R2?

After much procrastination from our accounting office, we're finally approved to transition our servers to 2012 R2 from 2003. I'm trying to determine which order I should tackle things though. We have primary and secondary servers on-site, our
secondary servers were at a colo site but the location was extensively damaged by a tornado. Here's what we've got in no particular order (all are Server 2003 unless otherwise noted):
2 DC's (AD, DHCP)
2 Exchange 2003 (planning a double hop upgrade to 2013 in the near future)
2 file servers
1 RD Gateway server (Server 2008)
2 terminal servers
2 database servers (SQL 2005)
1 fax server
There may be some issues with the SQL servers, and I'm working that out with the insurance software vendor we use. I'll probably go with 2012 R2, and SQL 2014 with compatibility set to SQL 2005. We're transitioning to their new software within
the next few years which will fully support SQL 2014. Thanks for any advice!

1. Make sure the domain functional level is 2003
2. Do the following systems in the following order:
2 terminal servers
1 RD Gateway Server
1 fax server
2 file servers
2 Email Servers
2 database servers
2 domain controllers
Reasoning: The terminal servers, RD gateway, fax, and file servers are low risk upgrades. The higher risk upgrades are the email, database servers, and domain controllers.
The domain controller upgrade is typically pretty painless unless you don't have control of all of your FSMO roles, or, your replication is not working properly. Check this out:
http://blogs.technet.com/b/canitpro/archive/2014/04/02/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012.aspx
The email servers can be painful. It takes a lot of work to setup the transport rules and the system for an upgrade, mailbox move, etc. Have you thought about using office 365? That might help you make the move from 2005 to 2013 in one hop. It may save you
money too. Just a thought. Check this out:
http://blogs.technet.com/b/canitpro/archive/2013/05/31/step-by-step-migration-of-exchange-2003-server-to-office-365.aspx
The database server upgrades are highly dependent on what applications are using these systems. Some of the applications require a full reinstall to get them to function on a new database server. Others require just updating the software, configuration file,
or registry setting to move them to a different database server. This shouldn't be too difficult.
Entrepreneur, Strategic Technical Advisor, and Sr. Consulting Engineer - Strategic Services and Solutions Check out my book - Powershell 3.0 - WMI: http://amzn.to/1BnjOmo | Mastering PowerShell Coming in April 2015!

Server 2003 SBS (with Exchange 2003) migrate to new machine Server 2012 Standard (with Exchange 2013)

This is what I have:
A very outdated machine running a small domain, SBS 2003 and Exchange - this is the ONLY server currently.
This is what my boss ordered:
A Dell R210 II machine with Server 2012 Standard (and I downloaded the trial for Exchange 2013).
He wants the old server completely replaced and gone - with everything moved over (including Exchange) to the new machine. The main reason for the upgrade is that not all users can access email on their machines (Macs, new versions of Outlook, etc.)
I have set up a new standalone server before but never migrated one - and I've found that going from SBS2003/Exchange2003 to Server2012/Exchange2013 is not simple in the least.
I thought I could just set up the new server as a DC on the domain and have everything replicated to it from the source server. Then I could decommission the old server. I have been told that 1) I can't upgrade Exchange 2003 to 2013 and 2) that I shouldn't
put Exchange on a DC. What do you do if you only have the one server?

Hi,
Just additional. Please also refer to following threads and article, then check if can help you.
Migrate
SBS 2003 to Windows Server 2012 Standard
Migration
SBS 2003 to Windows Server 2012 Standard
Transition
from Small Business Server to Standard Windows Server
Hope this helps.
Best regards,
Justin Gu

Migrating From Window Server 2003 to Window Server 2012 for Web server deployment and Developmemt Machine is on Window Server 2008

Hi Microsoft Team,
We need your urgent advice and that is also on priority:
Issue Description: We need to migrate from
WINDOW SERVER 2003 to WINDOW SERVER 2012 while the development activity will be carried
under WINDOW SERVER 2008 as DEVELOPMENT BOX.
.NET Framework Version: 3.5 ( For both DEVLOPMENT(WINDOW SERVER 2008) and WEBSERVER(to WINDOW SERVER 2012))
IIS Version: 7.5 (For both DEVLOPMENT(WINDOW SERVER 2008) and WEBSERVER(to WINDOW SERVER 2012))
Need your quick advice Is that configuration feasible for Development and
Deployment (Web Server).
Highly appreciate your response as this will depend which product we need to buy also if you feel any showstopper or concern. Please let us know.

Hi,
As suggested by Tim, in order to get better assistance, we can ask for help in the following IIS forum.
IIS Forum
http://forums.iis.net/
In addition, regarding migrating from Windows Server 2003 to Windows Server 2012, the following blog can be referred to for more information.
Step-By-Step: Active Directory Migration from Windows Server 2003 to Windows Server 2012
http://blogs.technet.com/b/canitpro/archive/2013/05/27/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012.aspx
Best regards,
Frank Shen

Server 2012 CDP PKI Setup on Subordinate CA - Active Directory Certificate Services could not create an encryption certificate

Hi,
When I check pkiview.msc on my 2012 Subordinate CA I get the error shown in the first picture below. I'm also getting errors similar to below in the event log:
"Active Directory Certificate Services could not create an encryption certificate. Requested by contoso\admin1. The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE)."
I'm assisting in setting up a 2 tier PKI infrastructure using Windows 2012. The root CA looks good, but we're getting errors on the subordinate. The server was working, but we discovered that the server would only issue certificates with a maximum of a 1
year expiry date - obviously no good, so we decided to run through the following commands on the root CA (as recommended byhttp://www.techieshelp.com/subordinate-ca-increase-certificate-validity/)
certutil -setreg ca\ValidityPeriodunits "Years"
certutil -setreg ca\ValidityPeriod "5"
restarted AD certificate services on the root and subordinate CA.Then did the following on the subordinate CA:
1.On the Subordinate CA create a new CA request by right clicking the server in ADCS and select New Request.
2.Supplied the original request file from the subordinate CA (I couldn't find a way of generating a new request file)
3.Issued the certificate using the Root CA.
4.On the Subordinate CA ADCS installed new CA cert.
However, I keep on getting CDP or AIA errors on my subordinate CA.Also I'm missing a CDP field value when I look at the certificate listed in the personal and trusted certification authority store on my subordinate CA.
In addition, when I look at my CDP locations in Certificate Authority, I see a lot of CDPs, but I'm not sure if I need them all - I suspect I could just get away with LDAP, the C:\windows path and a single http:// path.
I've tried renewing the existing certificate and CRL on my subordinate CA, but that didn't work either.
Please advise.
Thanks

Ok, the process to renew the subordinate CA is incorrect. Once the registry setting to change the validity period was made on the root CA, the root CA ADCS service needs to be restarted. That is the only time those keys are read. Then:
1) On the subordinate CA, open the CA tool, right click the CA and select Renew CA Certificate. You can use the same key, no need to create a new one. It will create a NEW certificate request file
2) Copy that to the Root CA and submit like you would have done during the initial install
3) Approve the request and export the issued certificate
4) On the subordinate CA, in the CA tool, right click the CA and choose Install CA Certificate.
You can not reuse request files.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years.

Migrate SBS 2003 to Windows Server 2012 Standard

We currently have two servers (SBS 2003 Standard utilizing Exchange 2003; Windows Server 2003 R2 Standard with SQL 2005).
We want to retire the SBS or maybe both.
We have purchased a new server (Windows Server 2012 Standard with licenses for Exchange 2013 and SQL 2012).
Is there a whitepaper that describes how to migrate SBS 2003 to Windows Server 2012 Standard?
Is it possible to run Exchange 2013 on the Windows Server 2012 box? In Hyper-V? If Exchange can run in a virtualized instance, do we need additional licensing to run another instance of Windows Server 2012 Standard?
Can we run SQL 2012 on the same Windows Server 2012 box?
We have about 35 users.

Sal,
Migration went fine. Steps i took:
Join 2012 Standard server as member.
Migrated roles.
I ended up manually creating new shares. The old environment was a mess.
Robocopy data/verified.
Seize FSMO roles
http://support.microsoft.com/kb/255504
Metadata cleanup
http://support.microsoft.com/kb/216498
Good luck

Migration from CA service desk to SCSM 2012 r2

Does any one have experience with migrating from CA Service Desk to SCSM 2012 R2?
How did you accomplish the migration

This is a common misconception about IT Service desk software, and a common reason that most helpdesk and service desk implementation fail miserably; that this something that you can just swap in and out like an email system. A service desk system isn't
just a file sharing site that you can forklift your data from and move on like before. Your service desk software is an
ERP for IT. Your Service Desk software is somewhere between a model of your IT department and a 5th column manager for your IT staff.
The typical methodology for doing this type of migration is to construct a straw model of your IT department, specifically your service book and work groups, and review your service book and incident handling procedures. once we have a solid understanding
of how your department actually runs at a conceptual and work item level, we can build a model of those work flows into service manager.
At that point, once we have a functional model of your department constructed in service manager, then we can start moving config item data. For 8 out of 10 implementations, this is better accomplished using a fresh discovery of config items from original
sources, which can then be reused to create an update methodology.
Provance's DMP (and to a lesser extent, the out of the box connectors, like the CSV connector) is a great tool for this, since it lets you build import templates that can be periodically run to update new data like purchases
for work items, a Knife edge cutover day is the simplest conversion, but certainly not the only option, that is, you decide January 15th is the day that the new system is available, and all work items go into the old system until January 14th,
and the old system will be locked for new requests on the 15th. any work in the old system is worked and closed using the usual process (even after the 15th) until the old system fades into obsolescence over the next 30 or 60 days.
You might notice that for medium enterprises (5,000 employees or so), this process typically takes several weeks of prep, and a couple of months of implementation, and it scales fairly linearly based on the size of your IT department. small departments
(somewhere below 20 analysts) can be done in a month or so, and very large IT groups, this can take a year or more.

Replace Windows 2003 DC with Windows 2012 R2 Foundation

Hi
We are a small office (7 users) that currently have one Windows 2003 Server configured as a domain controller running DNS,DHCP and file services for users. All computers (7) are joined into local domain. All users have mapped drives to 2003 server shares
and redirected (offline) folders for my-documents configured.
Due to an old hardware, we decided to buy a new server with Windows 2012 R2 FOUNDATION licence. For our company I thing this will be the best choice, since Foundation has CAL's 'included' in license, and for our requirements will be more than enough.
Foundation server limit is that server must be the root domain controller in a domain that has no trusts at the root of the forest. My question is how can we 'replace' old server with a new one (what are the steps) ? I'm thinking the following scenario:
- install server and promote it to a DC with a new local domain name in the new forest
- copy all data from old server the the new one
- put all computers out of old domain and put them back into the new domain that is running on 2012 foundation.
- power off old server
Most of the work will be with computers, that need to be reconfigured to a new domain ?
Is this the right approach, are there any other (better) options ?
Just thinking... Is it possible to join 2012 Foundation into existing domain, than transfer all roles from old server to the new one, and at the end demote old server and power it off (I know this is standard approach in Windows Server Standard editions
Thank you in advance
Mike

Hi,
There is no necessary to create a new domain. we can add the new DC to your current domain, then transfer FSMO, related settings and main service roles to the new DC.
Reference the link provided by Alceryes to add Windows Server 2012 R2 to your current domain. and then reference link below for
Active Directory Migration from Windows Server 2003 to Windows Server 2012 R2：
http://blogs.technet.com/b/canitpro/archive/2014/04/02/step-by-step-active-directory-migration-from-windows-server-2003-to-windows-server-2012.aspx
Besides, for DHCP migration from 2003 to 2012, you can reference：
http://blogs.technet.com/b/canitpro/archive/2013/04/29/step-by-step-migration-of-dhcp-from-windows-server-2003-to-windows-server-2012.aspx
For DNS migration, install DNS server role on Windows Server 2012 R2, and configure it as secondary DNS servers to the old DNS servers. Do replication, once completed, change it from secondary to primary. Remove old server and also clear their record in
new DNS. Checklist: Migrate a DNS Server(also applied for WS 2012 R2), for your reference:
https://technet.microsoft.com/en-us/library/cc755303.aspx
It is better to do a test lab and backup related data before migration in your current environment.
Best Regards,
Eve Wang
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Certificate issues Active Directory Certificate Services could not process request 3699 due to an error: The revocation function was unable to check revocation because the revocation server was offline. 0x80092013

Hi,
We have some problems with our Root CA. I can se a lot of failed requests. with the event id 22: in the logs. The description is: Active Directory Certificate Services could not process request 3686 due to an error: The revocation function was unable to
check revocation because the revocation server was offline. 0x80092013 (-2146885613). The request was for CN=xxxxx.ourdomain.com. Additional information: Error Verifying Request Signature or Signing Certificate
A couple of months ago we decomissioned one of our old 2003 DCs and it looks like this server might have had something to do with the CA structure but I am not sure whether this was in use or not since I could find the role but I wasn't able to see any existing
configuration.
Let's say that this server was previously responsible for the certificates and was the server that should have revoked the old certs, what can I do know to try and correct the problem?
Thank you for your help
//Cris

hello,
let me recap first:
you see these errors on a ROOT CA. so it seems like the ROOT CA is also operating as an ISSUING CA. Some clients try to issue a new certificate from the ROOT CA and this fails with your error mentioned.
do you say that you had a PREVIOUS CA which you decomissioned, and you now have a brand NEW CA, that was built as a clean install? When you decommissioned the PREVIOUS CA, that was your design decision to don't bother with the current certificates that it
issued and which are still valid, right?
The error says, that the REQUEST signature cannot be validated. REQUESTs are signed either by itself (self-signed) or if they are renewal requests, they would be signed with the previous certificate which the client tries to renew. The self-signed REQUESTs
do not contain CRL paths at all.
So this implies to me as these requests that are failing are renewal requests. Renewal requests would contain CRL paths of the previous certificates that are nearing their expiration.
As there are many such REQUEST and failures, it probably means that the clients use AUTOENROLLMENT, which tries to renew their current, but shortly expiring, certificates during (by default) their last 6 weeks of lifetime.
As you decommissioned your PREVIOUS CA, it does not issue CRL anymore and the current certificates cannot be checked for validity.
Thus, if the renewal tries to renew them by using the NEW CA, your NEW CA cannot validate CRL of the PREVIOUS CA and will not issue new certificates.
But it would not issue new certificates anyway even if it was able to verify the PREVIOUS CA's CRL, as it seems your NEW CA is completely brand new, without being restored from the PREVIOUS CA's database. Right?
So simply don't bother :-) As long as it was your design to decommission the PREVIOUS CA without bothering with its already issued certificates.
The current certificates which autoenrollment tries to renew cannot be checked for validity. They will also slowly expire over the next 6 weeks or so. After that, autoenrollment will ask your NEW CA to issue a brand new certificate without trying to renew.
Just a clean self-signed REQUEST.
That will succeed.
You can also verify this by trying to issue a certificate on an affected machine manually from Certificates MMC.
ondrej.

Could not connect to the Active Directory. Active Directory Certificate Services will retry when processing requires Active Directory access

Event properties – Event 91, Level Error, Event ID 91, Date and time 5/10/2012 11:29:48AM, Service CertificationAuthority
General:
Could not connect to the Active Directory.
Active Directory Certificate Services will retry when processing requires Active Directory access.
We have a Windows 2008 Server Enterprise with AD . I would like to enable the service "Certificate Services" that
allow me to enable radius to authenticate users wireless with the active directory.

Hi,
Can you please check this forum or someone from Microsoft, as we have post here dating back from October that are not being answered.
Everything for us is exactly the same as szucsati and Racom
NMNM,
Please give us an answer on this as the link provided is absolutely useless.
Thank you.

Server 2008 R2 Certificate services web enrollment

Not sure if this is the right place for this, but here goes.
Upgraded a domain to 2008 R2. Migrated certificate services to 2008 R2 Enterprise root on a member server.
Autoenrollment works fine
Requesting cert from the MMC using certificates snapin works fine
Requesting a cert via the web https://servername/certsrv gets the following error;
Active Directory Certificate Services denied request 12345 because the request subject name is
invalid or too long 0x80094001 (-2146877439)
Error constructing or publiching certificate.
I created a new cert template and did NOT check use Active Directory for subject name as templates with this checked
do not show up in the web enrollment interface.
I have enabled this template for enrollment and gave users rights to enroll.
They are clicking advanced in the web interface as they want a computer cert.
For the subject name, they enter computername.domain.local
Based on searches I've done on the InterWeb, permissions APPEAR to be correct.
Again, Autoenroll and MMC work just fine. Appears to be confined to only web.

They are clicking advanced in the web interface as they want a computer cert.
For the subject name, they enter computername.domain.local
Be aware that the web enrollment pages does not support computer certificates and you need to issue the certificate to the user and import it to the computer store
/Hasain

How to override event 77 from Certificate Services

Whenever I reboot a domain controller that a certificate server is using, the certificate server generates an event 77:
The "Windows Default" Policy Module logged the following warning .... The active directory connection to .... has been re-established.
This then puts my server into an unhealthy state.
However the server has recovered by this time and I want to stop having to manually reset the health.
System Center Operations Manager 2012 R2.
CarolChi

Thanks I know how to do that.
What I don't know is how to separate out one individual event from the several that cause this alert
http://technet.microsoft.com/en-us/library/dd300147(v=ws.10).aspx
Event 9: Source: Microsoft-Windows-CertificationAuthority. "Active Directory Certificate Services did not start: Unable to load a policy module."
Event 43: Microsoft-Windows-CertificationAuthority. "The "%1" policy module "%2" method caused an exception at address %4. The exception code is %3."
Event 44: Microsoft-Windows-CertificationAuthority. "The "%1" policy module "%2" method returned an error. %5 The returned status code is %3. %4"
Event 77: Microsoft-Windows-CertificationAuthority. "The "%1" policy module logged the following warning: %2"
Event 78: Microsoft-Windows-CertificationAuthority. "The "%1" policy module logged the following error: %2"
I would like to exclude Event 77 from the alert. but not the others..
CarolChi

Migrating 2003 certificate services to 2012

Similar Messages

Maybe you are looking for