PKI migration from 2003 to greenfield 2008 R2 plan-of-approach

Question

Hi,
I've done a lot of reading here already but I'm on a dead end. Here's my scenario:
I have 1 Stand-alone root CA plus 2 Enterprise issuing CA's, all running Windows Server 2003. I'm trying to move all servers to a new OS platform: Server 2008 R2. The way I'm seeing this is I have to migrate the Root CA first, then all issuing CA's, so my
first question is:
1. Is this correct?
I followed this procedure:
http://technet.microsoft.com/en-us/library/cc742388(v=ws.10).aspx. At "To set up a CA on a computer running Windows Server 2008" I specified the backup I made earlier and specified the private key from the 2003 stand-alone root CA. After
the wizard finishes, I am able to succesfully start the CA on the 2008 server. Next chapter is "Restoring the database and configuration on the target computer". It prompts to shut down the CA service, which I allow, it restores the DB (which
I point to as part of the wizard), when it finishes restoring, it prompts to start the CA service again. This is where the headache starts; it throws an ADCS error "0xc8000220 (ESE: -544)" and it fails to start.
The application log on the target server throws the following errors (in chronological order) :
[source: ESENT - EventID: 916] certsrv.exe attempted to attach database 'C:\windows\system32\certlog\<CANAME> but it is a database restored from a backup set on which hard recovery was not started or did not complete successfully'
[source: CertificationAuthority - EventID: 17] "Active Directory Certificate Services did not start: Unable to initialize the database connection for <CANAME>. Error: 0xc8000220 (ESE: -544).
I have no idea as to what this means so my next Obvious question would be:
2. Please advice in my next step?
Cheers!
Check out my blog you-n-it.net

Answer 1

Kurt,
Thanks for your reply.
Unfortunately I'm still not able to migrate an out-of-the-box stand-alone root CA 2003 to a 2008 server. Using the same or another host name. I'm at a dead end. One thing I noticed is:
When running esentutl /g on the running CA DB (in a lab) things are ok. Running it on the back-upped version of the db, it says it's corrupted. esentutl /r does NOT repair it. esentutl /p does, and afterwards it's verifiable using esentutl /g but it's still
not possible to bring it online. I've followed
http://technet.microsoft.com/en-us/library/cc742388(v=ws.10).aspx to the letter and I've read other sites as a comparison (not doubting, merely looking for success stories based on this procedure) and it seems like I'm the only one in the world that's unable
to perform a successful restore! :( Anywhere I can dig deeper?
This error is my nemesis: [ESENT: 412] certsrv.exe (2824) Restore0001: Unable to read the header of logfile C:\Windows\system32\CertLog\edb00003.log. Error -546.
Cheers!
Check out my blog you-n-it.net