Move Certification Authority Web Enrollment to new server issue.

Hello,
i'm trying to move the Certification Authority Web Enrollment from one server to a new one. I've got a fully functional server where i can enroll any certificate i want and everything is working properly.
on the new server i configured I'm facing a problem that seems to be an impersonation issue. Indeed, while i try to enroll a certificate i get the following error msg from the interface :
Request Mode:
newreq - New Request
Disposition:
(never set)
Disposition message:
(none)
Result:
The RPC server is unavailable. 0x800706ba (WIN32: 1722)
COM Error Info:
CCertRequest::Submit: The RPC server is unavailable. 0x800706ba (WIN32: 1722)
LastStatus:
The operation completed successfully. 0x0 (WIN32: 0)
Suggested Cause:
This error can occur if the Certification Authority Service has not been started.
an i can also see on the CA it targets the following application error event :
Event 18209, ComRuntime:
The application-specific permission settings do not grant Local access permission to the COM Server application C:\Windows\system32\certsrv.exe with APPID
{D99E6E74-FC88-11D0-B498-00A0C90312F3}
to the user NT AUTHORITY\ANONYMOUS LOGON SID (S-1-5-7) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
While i register a certificate on the server were it all works fine i can see event in the Security log on the CA that authenticate the user i generate the certificate with, where-as with the server were it does not work, all seems to be anonymous.
IIS configuration are identical on both servers and the delegation has been set identically too ( ADUC object )
Any idea how what I could check next?

Hi,
Regarding event 18209, please follow steps from this article below to assign access permissions for the user mentioned in the event message:
Event ID 18209 — COM Security Policy Configuration
http://technet.microsoft.com/en-us/library/cc726319(v=WS.10).aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]

Similar Messages

Usefullness of Certification Authority Web Enrollment?

If a deployment has Certificate Enrollment Web Service and
Certificate Enrollment Policy Web Service installed is there still a need for
Certification Authority Web Enrollment? This Windows Server 2012 CA design has an offline root CA, two Enterprise Subordinate CAs in a cluster, and two web servers hosting AIA/CDP/OCSP/CES and CEP behind a load balancer. There is
also a standalone NDES server.
Thanks

Starting with Windows Server 2008, web enrollment become useless as it allows only user certificates, therefore you should avoid web enrollment installation whenever it is possible. As for CEP/CES, there is a dependency that only Windows 7+ supports it.
My weblog: http://en-us.sysadmins.lv
PowerShell PKI Module: http://pspki.codeplex.com
Check out new:
PowerShell FCIV tool.

Certification Authority Web Enrollment Install Error

Hello
We have moved our certification authority from "Windows Server 2008" to "Windows Server 2008 R2" according this blog entry:
http://www.scottfeltmann.com/index.php/2010/03/02/move-root-ca-from-w2k3-to-w2k8/
It works perfectly. After that we wanted to install "Certificate Authority Web Enrollment" in Server Manager, but the following error appears:
"Cannot install Certification Authority Web Enrollment, Active Directory Certificate Services setup failed with the following error: The parameter is incorrect. 0x80070057 (WIN32: 87)"
Thanks for any help!
Regards
netbit

Hello Marcin
Thanks for your answer. The CA is now on a single server without any roles installed.
There are no events in the eventvwr for this error or anything else.
Just for clarification: If i try to select "Certificate Authority Web Enrollment" in the servermanager the error appears:
Screenshot: http://giezi.com/public/servermanager-error.PNG
Thanks!
Regards
Reto

Certification Authority Web Enrollment

Can I install one CAWE role (proxy) to be use as web pages for more then one CA?

No, it is not supported.
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.

Migrating web sites to new server

Hello all,
just got a new Mac Mini Server edition with the latest Snow Leopard etc. I am migrating all my various sites from the old server which was just running standard Leopard. I am having a hard time finding where everything goes. If anyone can point me to some good tutorials on setting of web hosting using Snow Leopard I'd really appreciate it.
For example, we use the server for local testing only, not public serving so on the old server we'd just go to http://192.168.1.5/sitename and that worked great. So where the heck is htdocs located on Server? Most of are sites are PHP/MySQL stuff like Wordpress and Joomla etc. So I'm guessing I'll need to enabled PHP 5 and MySQL and all that. I've got a few good tutorials bookmarked for that, but if anyone has a great Server specific one, let me know. I'll be porting everything using phpMyAdmin.
Looking at the help info for the Web Server Preferences, it says adding sites is for static HTML sites of which I have basically none.
I'm going through the Server booklet that came with the Mini, but I could really use some tips on where to put things like our shared project folders etc. I'm new to this server configuration stuff. Thanks a ton for any tips!

I am trying to do the same thing. I have an old Leopard server that has some internal websites on it. I am planning to migrate them over to a new Snow Leopard server this summer. I am just now starting to play with it. I wave been able to successfully move over wikis, but am having trouble with the user blogs.
To move the wikis, I found them in /Library/Collaborarion/Groups. Each wiki was listed as a separate directory. I moved the contents of the groups folder over to the new server in the same directory, and changed the permissions to those directories to match what they should be. To do this, I went into Server Admin and file sharing and browsed to the Groups folder (no further in) and propogated the permissions (owner and group names) down to the contents of the Group folder fo that each user and group was _teamserver. Shop and restart web server and the wikis were back.
I tried to do the same for the users, but that does not seem to work. Still trying some things there. I did not do any of the things that power mac suggested with php or mysql.
Hopefully, this works for you. I will try to post if I can figure out the user blogs. I would have thought they would have worked the same way as the wikis, but they were in the users folder instead of the groups folder. They are all listed there in the finder, but they do not show up in the web interface when I list the user websites in snow leopard.

SBS2008: Move email from Exchange 2007 to new server with Exchange 2013

We have an old server (SBS2008) and plan to buy a new server with (Server 2012). I need to move all the exchange emails, contacts & calendars to the new server. We will no longer use the old server.
Is there a document or migration tool that will help me understand how to move this data form the old exchange server to the new one?
Old Server:
SBS2008 running Exchange 2007
New Server:
Server 2012
Exchange 2013
Any help is appreciated!

Hi Dave,
It can be done, and as Larry suggested you will consider two Server 2012 installs in order to achieve an environment that looks like your current SBS roles; Exchange 2013 on an Active Directory controller isn't a good long-term solution (SBS did this for
you in the past).
For your size operation, a virtual server host, with a Windows Server 2012 license, and two virtual machines would probably be a suitable design model. In this manner, you have Server 2012 license that permits 1 +2 licenses (one host for virtualization,
up to 2 Virtual Machines on same host).
There's no migration tool. That comes with experience and usually trial and error. You earn the skills in this migration path, and for the average SBS support person you should plan on spending 3x (or more) your efforts estimate in hours planning your migration.
You can find a recommended migration path at this link to give you an idea of the steps, but its not exactly point by point going to cover you off for an sbs2008 to server 2012 w/exchange 2013 migration. But the high points are in here. If it looks
like something you would be comfortable with then you should research more.
http://blogs.technet.com/b/infratalks/archive/2012/09/07/transition-from-small-business-server-to-standard-windows-server.aspx
Specific around integrating Exchange 2013 into an Exchange 2007 environment, guidance for that can be found here:
http://technet.microsoft.com/en-us/library/jj898582(v=exchg.150).aspx
If that looks like something beyond your comfort level, then you might consider building a new 2012 server with Exchange 2013 environment out as new, manually export your exchange 2007 mailbox contents (to PST) and then import them into the new mail server,
and migrate your workstations out of old domain into new domain. Whether this is more or less work at your workstation count is dependent upon a lot of variables.
If you have more questions about the process, update the thread and we'll try to assist.
Hopefully this info answered your original question.
Cheers,
-Jason
Jason Miller B.Comm (Hons), MCSA, MCITP, Microsoft MVP

Scale out sharepoint server search to index server and Microsoft SharePoint Foundation Web Application to new server

Hi
in my single server these below service are running:
SharePoint Server Search
User Profile Service
Microsoft SharePoint Foundation Web Application
here how i scale out Microsoft SharePoint Foundation Web Application to another server
and SharePoint Server Search to new index server.
adil

Check here to see how to add servers to the farm:
http://technet.microsoft.com/en-us/library/cc261752(v=office.15).aspx
What Inderjeet meant was that if you chose to install SharePoint as a single server instead of a complete farm, you won't be able to add servers to the farm at a later time. You can check if this is the case by checking the registry key he mentioned. If
that is indeed the case, there's nothing to it but reinstall the farm.
So that is why you never should choose the single server option, it locks you in and limits future options, while choosing to install sharepoint as a complete farm it's still perfectly acceptable to host it on a single server.
Kind regards,
Margriet Bruggeman
Lois & Clark IT Services
web site: http://www.loisandclark.eu
blog: http://www.sharepointdragons.com

Move Adobe Connect 7.5 to new server hardware

What is the process for moving Adobe Connect to new server hardware. We are currently running Adobe Connect Pro 7.5 (7.5.1.0.100) on a Win2K3 SP2 server. We would like to move Connect over to new server hardware running Win2K8 R2 (64-bit). The Connect database will remain on a separate Win2K3 SP2 / SQL 2005 sp4 server.
Unless it will pose a problem, the NETBIOS computer name will be different. However, the IP address and FQDN will remain the same.
What is the recommended procedure for doing this?
PS - Shortly after moving to new hardware, we plan to upgrade to Connect 8. Is it better to upgrade first, then move to new hardware? Or vice-versa?

Hi,
moving to new hardware is basically a new install on the new server, then moving over backed up content, then reconnecting to the database.
It makes no difference if you upgrade first and then move hardware or move first and then upgrade. I'd move first and make sure Connect works fine on the new hardware, then upgrade.
Here are some steps that should work.
1. make sure your new hardware, OS and SQL Server are supported
     http://help.adobe.com/en_US/connect/8.0/installconfigure/connect_8_install.pdf
    (for 7.5 check the requirements here: http://www.adobe.com/products/acrobatconnectpro/systemreqs/#proserver )
2. Take a backup of your current content directory and all customised config files.
    (the config files will be a reference to restore SSL or other modifications, do not just move them back in once upgraded).
3. Take a backup of your database and make sure you know the login and password to your SQL server.
4. Stop the services on the old server
5. If also moving DB, attach your DB backup to the new SQL host.
6. Install Connect on the new hardware.
7. Do not start the services yet, first restore the backed up content.
8. start the services, bring up the console and connect to the DB.
9. check your settings in the console, a restart might be required first.
10. Does the login page load?
11. Follow the install guide from step 1 to re-apply SSL config if required (in Connect 8 this is done slightly different than in C7)
Changing the windows machine name, can cause trouble, not always, but it's easiest to just re-use the name on the new hardware.
If that's not an option, an entry in the conenct DB needs to be updated:
http://kb2.adobe.com/cps/407/kb407446.html
I am fairly certain these steps will work, but cannot test this and I do not know your exact environment, so I can give no guarantee this will work. It is always good to just test the move to new hardware and if things go wrong, bring the old system back into production and contact support.
Good luck!
Kay

Certificate Authority Web Enrollment - CSP states loading

Hello,
I have setup an enterprise sub CA (the root is offline).
I have been able to issue certificates, but I did not have the Web Service, Policy Web Service or the Web Enrollment turned on.
I turned them on yesterday and when I visit the website, when I click Create and submit a request to this CA it takes to the next page where I can request a certificate. I created a duplicate template for the User Certificate and made it available.
I see it in the drop down, however under key options, CSP just says loading. I went to this site:http://support.microsoft.com/kb/939290 and followed the instructions, Active Scripting is enabled and it still
continues to state loading.
I am at a complete loss as to what the problem might be. Event logs on CA server are clean, no errors or warning.
Any suggestions?
Update: I tried to get to the site from the actual CA server and it displays the The Web site is attempting to perform a digital certificate operation on your behalf, etc...
And it populated the CSP.
I tried it from another server and it worked.
I tried it from another workstation and it shows loading in the CSP.
Has anyone run into this issue?

Hi,
As this works on one of your servers, whether all your workstation have this issue?
Certificate Enrollment Web Services client computers must be computers running at least Windows 7 or Windows Server 2008 R2 operating systems. To utilize key-based renewal, client computers must be running at least Windows 8 or Windows Server 2012 operating
systems.
Please follow the below article for more details:
http://social.technet.microsoft.com/wiki/contents/articles/7734.certificate-enrollment-web-services-in-active-directory-certificate-services.aspx
Regards,
Yan Li
Regards, Yan Li

How can I move the distribution database to a new server?

I need to migrate an old distribution database to a new VM. My understanding is that you can detach/attach the distribution DB to make this easier. What are the 'gotchas' in this process? Do I need the detach/attach the system databases as well? The distributor
is facilitating data from Oracle to SQL Server.
Another question.. what are some good benchmarks for figuring out how much horsepower I should have set up in my VM that running distribution?
Thanks,
phil

Hi philliptackett77,
As your description, you want to migrate the distribution database to a new server. Based on my research, you need to remove the replication, create the distribution on the new server, and recreate publication and subscription according to Satish's post.
So you don’t need to detach or attach the distribution database or system databases.
To make this process simple, you could use SQL Server Management Studio (SSMS) to generate scripts and run the scripts to recreate publications and subscriptions or drop publications and subscriptions as the screenshot below. Checking ‘To create or enable the
components’ generates the script for creating the publications and subscriptions, and Checking ‘To drop or disable the components’ generates the script for dropping the publications and subscriptions.
Firstly, please use SSMS to generate the script which is used to create publications and subscriptions.
1.Connect to Publisher, or Subscriber in SSMS, and then expand the server node.
2.Right-click the Replication folder, and then click Generate Scripts.
3.In the Generate SQL Script dialog box, check ‘To create or enable the components’.
4.Click Script to File.
5.Enter a file name in the Script File Location dialog box, and then click Save. A status message is displayed.
6.Click OK, and then click Close. For more information about the process, please refer to the article:
http://msdn.microsoft.com/en-us/library/ms152483.aspx
Secondly, follow the steps above, check ‘To drop or disable the components’ to generate the script used to drop publications and subscriptions. Then run the sript to drop publications and subscriptions.
Thirdly, please disable distribution using Transact-SQL or SSMS following the steps in the article:
http://technet.microsoft.com/en-us/library/ms152757(v=sql.105).aspx.
Fourthly, please create the distribution at the new server using Transact-SQL or SSMS following the steps in the article:
http://msdn.microsoft.com/en-us/library/ms151192.aspx#TsqlProcedure.
Last, please run the script generated in the first step to recreate publications and subscriptions.
Regards,
Michelle Li

How to move or copy a database to new server

Greetings All,
Oracle Enterprise 11g r2, on a Windows2008 platform.
I would appreciate some advice regarding moving/copying a database to a new server. Some of the information below may not be pertinent to my goal. Please be patient as I am a newbie.
I have installed oracle and created a database (prod03) on the new/target server. I created the same tablespaces (and datafiles/names) as are on the existing/source server (prod01), except that on the new/target server (prod03) there is 1 more data file for the USERS tablespace than there is on the existing/source server (prod01).
My initial thought was to perform a expdp full=y.
The database contains 220 schemas, when I performed an expdp full=y estimate only it indicated 220Gb. I think this would take much more time to export and then import than what I hope to be able to do below.
I would like to be able copy the datafiles from the source server prod01 server over to the target server prod03, some names/locations will change.
One scenario I found (http://www.dba-oracle.com/oracle_tips_db_copy.htm) was to backup the control file to trace on the old/source server (prod01). Copy everything to the new/target server. Tweak the file that creates the new control file.
Step 4 of the above mentioned link says to change
CREATE CONTROLFILE REUSE DATABASE "PROD01" NORESETLOGS to
CREATE CONTROLFILE SET DATABASE "PROD03" RESETLOGS
Notice the change from REUSE to SET. I am not sure if this is right for my situation.
Could I issue a backup control file to trace on the target server (prod03), add the reference to the additional datafile. Copy over all of the datafiles for all of the tablespaces (users,system/sysaux/undotbs1,temp),
Delete the existing control file, and generate the new control file.
Then perhaps issue a startup resetlogs or startup recover?
Thanks for your time,
Bob
Edited by: Snyds on May 17, 2012 12:26 PM

So unless someone provides me with an rman script I can't use rman.google is your friend
Simply telling someone to get the experience dose not help. So your post is useless to me.I suppose you do not have experience with "old-school" manual cloning as well.
Import of entire 200GB DB with datapump or imp will also require some experience otherwise it will be a long-long exercise.
So, basically, any advise may be useless to you, because of your "the fact is I don't have the experience. Nor do I have the time to obtain the experience."

Move apps tier to new server

Hi all,
here we have 2 node setup
node 1 : apps + db (cm + db)
node 2 : apps (web + forms)
requirement is we want to move node 2 to new server bcoz os team wants to do some maintainance on node 2.
is this possible to move only node 2 (web + forms) to new server through rapid clone n sync with existing cm and db node or we have to move entire setup to new servers
links n MOS doc ids highly appreciated
versions:
apps : 11.5.9
db: 9.2.0.8
os : RHEL 4
Thanks,
Haafiz

Yes it is possible and all you need to do is the following (you don't need to move node1):
- Install OS on the new server + OS pre-req software and packages
- Run preclone on node 2
- Shutdown the application on node 2 and copy the files to the new node
- Run postclone on the new node
- Clean FND_NODES and run AutoConfig
Oracle Applications Installation Update Notes, Release 11i (11.5.10.2) (Doc ID 316806.1)
Cloning Oracle Applications Release 11i with Rapid Clone (Doc ID 230672.1)
How to get a clean Autoconfig Environment ? (Doc ID 391406.1)
Thanks,
Hussein

Move/migrate ZFD to a new server

Using ZFD with the Sybase SQL Anywhere database. AWI, Inventory are the only processes (other than Sybase of course) that we need running.
The rest is "pure" eDir I believe (NAL, Remote Control)
The issue is that I need to move/migrate the ZFD 7 stuff from NetWare to OES2 SP2 Linux, but I cannot use the Identity transfer option
I THINK I can basically install the ZFD code onto the OES2 server, mount or copy the data on the NSS volume on NetWare to the data on OES2 server, and then edit the eDir objects to use the correct paths/IP?
Or am I wrong in thinking that.
ZCM is not an option at this point yet (due to a few bugs and some other logistical issues).
Oh, I don't care too much if I have to redo the Sybase databases from scratch. And I will also change the DNS for ZENWSIMPORT appropriately.

Originally Posted by magic31
Basicly, just install a new OES2 server, then install the ZenWorks services you want using the installer in the ZEN7_with_SP1_IR4a_DesktopMgmtLinux.iso media.
This is for ZDM on SLES, but installation points also apply for OES2 (like exporting the trusted root cert to be used by the ZenWorks agents : Install ZenWorks 7 on SLES 10 SP2 | DiWi )
If you are on OES2 SP2 also apply the IR4a HP3 (NOVELL: Downloads - ZENworks 7 Desktop Management on Linux Support Pack 1 Interim Release 4a Hot Patch 3)
Then configure a new ZenWorks Server policy so the settings are as you want em, move the DNS pointer to the new server, reconfigure PDHCP and your User/Workstation policies to reflect new paths where applicable.
That should cover most points... ZDM is quite easy to move about.
Hope that helps,
Willem
Okay in all seriousness now, it says it's installed with some non-fatal errors.
9 non-fatal errors to be exact.
Not sure if that's going to break something. Was complaining about jclient and stuff.
Install Action: Jump To: Next NO JUMP -- Prev: Choose Install Set
Status: ERROR
Additional Notes: ERROR - java.lang.VerifyError: Incompatible JClient/DClient package
JClient Revision: 1.3.1172
DClient Revision: 2.5.300
Install Action: Jump To: Next License Verified -- Prev: NO JUMP
Status: ERROR
Additional Notes: ERROR - java.lang.NoClassDefFoundError: com.novell.application.zenworks.install.configure. AuthConfigureAction
Install Action: Jump To: Next Samba Verified -- Prev: NO JUMP
Status: ERROR
Additional Notes: ERROR - java.lang.NoClassDefFoundError
Custom Action: com.novell.application.zenworks.install.installany where.customcode.InstallZenLicensing
Status: ERROR
Additional Notes: ERROR - class com.novell.application.zenworks.install.installany where.customcode.InstallZenLicensing.install() Unexpected Fatal Error:
Custom Action: com.novell.application.zenworks.install.installany where.customcode.InventoryServerConfigure
Status: ERROR
Additional Notes: ERROR - class com.novell.application.zenworks.install.installany where.customcode.InventoryServerConfigure.install( ) Unexpected Fatal Error:
Custom Action: com.novell.application.zenworks.install.installany where.customcode.SetFailedComponent
Status: SUCCESSFUL
Custom Action: com.novell.application.zenworks.install.installany where.customcode.SybaseConfigure
Status: ERROR
Additional Notes: ERROR - class com.novell.application.zenworks.install.installany where.customcode.SybaseConfigure.install() Unexpected Fatal Error:
Custom Action: com.novell.application.zenworks.install.installany where.customcode.AWSConfigAction
Status: ERROR
Additional Notes: ERROR - class com.novell.application.zenworks.install.installany where.customcode.AWSConfigAction.install() Unexpected Fatal Error:

Move appset to new server and new version

Hi
I am currently on 5.1, SQL 2005 and Windows 2003, where we have some performance issues. To see the effekt of an upgrade I would like to move my current appset to a new server with BPC 7.5 SQL 2008 and Windows 2008.
How should I do this?
Can I make a clean installaion of BPC 7.5 on SQL 2008 and then restore the 5.1 version appset into 7.5.
What is the recommended way to do this.

Hi,
There is nothing to worry.
You need to take the backup from the 5.1 system and restore it in 7.5 MS. After the restoration, please make sure that all the components are working fine or not. You might have to look at the security once again and the reports and the input schedules. There might be small small alterations / modifications required. However, there wont be any big development. There is only one area which needs little more concentration - SSIS packages. You might have to re-build the SSIS packages in SQL 2008. Another thing is that if you have any macros or VB in your templates, you might have to revisit them.
As a whole, I dont see much challenge in this whole process.
Hope this helps.

Certification Authority

We installed the Certification Authority service on a 2008 server. How do we issue a certificate to a user to allow them to digitally sign Excel and Word documents? When I try to sign a document the only certificate available says
it cannot be verified.

Hi,
Based on my research, we must obtain a digital certificate before we can obtain a digital signature. Therefore, we need to request a
Code Signing certificate for this usage.
Here are some related links below that could be useful to you:
Walkthrough: Request a Digital Certificate from Certificate Server or create a testing Digital Certificate to sign a Package
http://blogs.msdn.com/b/sqlforum/archive/2011/01/03/walkthrough-request-a-digital-certificate-from-certificate-server-or-create-a-testing-digital-certificate-to-sign-a-package.aspx
Description of digital certificates
http://support.microsoft.com/kb/206637
What is a digital signature?
http://technet.microsoft.com/en-us/library/cc545901(v=Office.12).aspx
I hope this helps.
Best Regards,
Amy Wang

Move Certification Authority Web Enrollment to new server issue.

Similar Messages

Maybe you are looking for