Remove a subordinate CA

I am in the process of setting up a PKI for our organisation. I have setup an Offline Root, Offline Policy Subordinate CA and an Enterprise Subordinate Issuing CA. Due to a number of issues I am required to remove the subordinate Issuing CA and reinstall
it. Following kb889250, I reach step 5 which runs certutil -key to display the key stores for the local CA. On running this command, no where in the output is the local CA listed. Why is this? Can I skip the step "deletion of the private key" and
go ahead and uninstall the CA?
We are using Windows 2008 R2.
Thanks
Devin

enterprise subordinate issuing CA
Hi Lutz
Thanks for your reply. Essentially I would like to uninstall the current enterprise subordinate issuing CA and then begin a fresh install. No cert's have been issued with this issuing CA so I see no need to maintain the same private key. The replacement enterprise
subordinate issuing CA will be installed under the existing offline Root and offline Policy structure.
I am running the certutil command from an elevated command prompt. Following is the output when run on the enterprise subordinate issuing CA;
Microsoft Windows [Version 6.1.7600]
 Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
C:\Windows\system32>certutil -key
 Microsoft Strong Cryptographic Provider:
   iisConfigurationKey
   6de9cb26d2b98c01ec4e9e8b34824aa2_GUID
     AT_KEYEXCHANGE
  iisWasKey
   76944fb33636aeddb9590521c2e8815a_GUID
     AT_KEYEXCHANGE
  MS IIS DCOM Server
   7a436fe806e483969f48a894af2fe9a1_GUID
     AT_KEYEXCHANGE, AT_SIGNATURE
  Microsoft Internet Information Server
   c2319c42033a5ca7f44e731bfd3fa2b5_GUID
     AT_KEYEXCHANGE, AT_SIGNATURE
  NetFrameworkConfigurationKey
   d6d986f09a1ee04e24c949879fdb506c_GUID
     AT_KEYEXCHANGE
CertUtil: -key command completed successfully.
C:\Windows\system32>
It would nice to clean up the key, but it sounds like it really isn't a major issue especially as we have not issued any cert's with this CA.
Thanks for your help.
Devin

Similar Messages

  • Removing a Subordinate CA

    First some background:
    OS: Server 2008 R2 STD
    I have one Enterprise Root CA on SERVER1 (brand new, standalone server, no issues)
    I also have one subordinate CA on SERVER2
    SERVER2 is also a DC
    I would like to completely remove the CA role from SERVER2 and maintain it's status as a Domain Controller only.  This would leave me with just one Enterprise Root CA on SERVER1.
    I'm in the process of reading through the following articles and trying this in a test environment:
    http://blogs.technet.com/b/pki/archive/2012/01/27/steps-needed-to-decommission-an-old-certification-authority-without-affecting-previously-issued-certificates-and-then-switching-all-operations-to-a-new-certification-authority.aspx
    http://support.microsoft.com/kb/889250
    Does anyone have any experience with this?  My main concern is: what happens to the certificates that were issued from SERVER2?  Any input is appreciated.

    1) Certificates are invalid after 2/2015 and should not be accepted by any application anymore - you would need a replacement CA to issue new certificates to these clients before. 2/2015 is the absolute latest time you can use those certificates, provided
    that valid CRLs are available until then (see 2)).
    2) Certificate paths are built by fetching CA certificates in HTTP or LDAP URLs in certificates (extension AIA), the revocation lists are retrieved from CRL distribution points - also HTTP and/or LDAP URLs (extension CDP). If you remove these servers or
    the files/objects published on them or if CRL published there are expired certificates could not be validated even before Feb. 02. Keeping the distribution points means that you need to make sure that at least one of the URLs in the certificates is still accessible
    and valid CA certs. or CRLs are published to these URLs.
    Creating a long-lived CRL would make sure that all applications validating those certificates are kept happy even if the CA had been retired and cannot publish new CRLs anmore.
    3) I would advise against doing this unless you are 100% sure that you don't need the certificates anymore or could replace them with ones from another CA immediately. Revoking all of them means you can't definitely validate them anymore, and large CRLs
    can cause issues with some applications.
    Caveat: Creating an 'eternal CA' means that you cannot reasonably do revocation in the future - so you should plan for replacing the certificates soon that you typically need to revoke (lost smartcards, e.g.)
    Elke

  • Search and Remove Subordinate Bookmarks

    First off, I'd like to say that I have been trying to figure this out for the the past 2 weeks. This is my last resort.
    What I'm trying to do:
    -Search bookmarks to find any bookmarks that contain "Page"
    -Put those bm's into an array, to be deleted
    -Delete the array that was created.
    Example of BM:
    Decisions
          1A: Decision (01/01/2010)
                 Page 1
                Page 2
                Page 3
                Page 4
    ((Same way through 10A:))
    Transfers
          1B: Transferred (07/26/2010)
                Page 1
                Page 2
                Page 3
                Page 4
    ((And so on for multiple pages and Bookmarks))
    This is the script I have, but keep getting errors on:
    var bm=searchBookmarks(this.bookmarkRoot, 1, "Page");
    console.println("End" + this.bookmarkRoot.name);
    //bm.execute();
    function searchBookmarks(bm, nLevel+, bmName)
    if (bm = null) return null;
    if (bm.name = bmName)
    console.println("Set: " + bm.name);
    bm.remove();
    return null;
    if (bm.children != null)
    console.println("Trash: " + bm.children.length);
    var s=""
    for (var i = 0; i < nLevel; i+++) s += " ";
    for (var i = 0; i < bm.children.length; i+++)
    var BmToDel = "Page" //bm to delete
    var arr = new Array(0);
    var bm;
    RemoveBookmarks(this.bookmarkRoot);
    while (bm = arr.pop()) bm.remove();
    function RemoveBookmarks(bm)
    if (bm.children != null)
    for (var i = 0; i < bm.children.length; i+++)
    RemoveBookmarks(bm.children[i+]);
    if (bm.name = BmToDel) { arr.push(bm); };
    The error I keep running into is shown below. I have to be blind to keep missing the ")"
    SyntaxError: missing ) after formal parameters
    4:Console:Exec
    undefined
    Can someone please assist me in this script? It's driving me crazy.

    George,
    That's exactly what I am aiming to do. I want to remove any bookmark that containts the text "Page" anywhere in the Bookmark name. I still want to keep the pages in the file, but trim off the unneeded bookmarks.
    I'm going to keep researching this myself and see if I can't figure it out, but a little assistance would be nice.
    I've been using the following as my resources:
    -Acrobat JS API Reference
    -Acrobat JS Scripting Guide
    Any others I should try?

  • Problems deleting computer objects-because of their subordinate objects

    We are running a 2008 R2 domain.  We have recently removed our techs out of Account Operators because we have read that is best practice.  Our techs now have problems deleting computer account objects that have the msmq active directory objects
    beneath the computer object.  Even if I give the techs full control permissions on those computer objects, they cannot delete them because they cannot delete the msmq subordinate AD objects.  The msmq objects are not showing a security tab, like
    other subordinate objects do.  If I delete the msmq objects with a Domain Admin account, then the techs can delete the computer objects.  Any ideas of how I can fix it so they can delete the msmq objects, without being Account Operators?
    Thanks,
    Dan Heim

    Hello,
    please see
    http://policelli.com/blog/archive/2009/11/06/understanding-adminsdholder-and-protected-groups/ and start with removing the flag for the mentioned accounts. Therefore see "Orphaned AdminSDHolder Objects" in the mentioned article.
    Best regards
    Meinolf Weber
    MVP, MCP, MCTS
    Microsoft MVP - Directory Services
    My Blog: http://blogs.msmvps.com/MWeber
    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.
    Twitter:  

  • Subordinate certification authority can't start ADCS service: The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE).

    Hi
    I have 1 rootCA and 1 subordinate CA. I removed one of the locations to publish CRL and after that the ADCS service can't start. I get the warning first:
    Revocation status for a certificate in the chain for CA certificate 2 for siu-SRVDC01-CA could not be verified because a server is currently unavailable.  The revocation function was unable to check revocation because the revocation server was offline.
    0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE).
    And then the error:
    Active Directory Certificate Services did not start: Could not load or verify the current CA certificate.  siu-SRVDC01-CA The revocation function was unable to check revocation because the revocation server was offline. 0x80092013 (-2146885613 CRYPT_E_REVOCATION_OFFLINE).
    I've read many threads with similar problems but I can't find the solution. The CDP is online. I've run "certutil -url cert.cer" to verify the CDP and AIA and everything is fine. But the service is still not starting.
    See this command too:
    C:\>certutil -verify -urlfetch subCADC01.cer
    Issuer:
        CN=siu-SRVDC02-CA
        DC=siu
        DC=domain
      Name Hash(sha1): 152a7c43f186d9179c1c3256d3a1a0af4a9df892
      Name Hash(md5): b409e417a38bbe04b5800512bd94efac
    Subject:
        CN=siu-SRVDC01-CA
        DC=siu
        DC=domain
      Name Hash(sha1): 5ee421b84c3b18ff134cf2e42226853d78d3409b
      Name Hash(md5): e1a454692361733e45dad374dc14cae3
    Cert Serial Number: 1e0000022c707c76c0a27b315700000000022c
    dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
    dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
    ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
    HCCE_LOCAL_MACHINE
    CERT_CHAIN_POLICY_BASE
    -------- CERT_CHAIN_CONTEXT --------
    ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
    ChainContext.dwRevocationFreshnessTime: 1 Hours, 2 Minutes, 16 Seconds
    SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
    SimpleChain.dwRevocationFreshnessTime: 1 Hours, 2 Minutes, 16 Seconds
    CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
      Issuer: CN=siu-SRVDC02-CA, DC=siu, DC=domain
      NotBefore: 19.03.2015 11:18
      NotAfter: 19.03.2017 11:28
      Subject: CN=siu-SRVDC01-CA, DC=siu, DC=domain
      Serial: 1e0000022c707c76c0a27b315700000000022c
      Template: SubCA
      a1a8a95464c5b586da6e9b304142d59fc5a22ae0
      Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
      Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
      ----------------  Certificate AIA  ----------------
      Verified "Certificate (0)" Time: 0
        [0.0] http://wwwca/CertEnroll/srvdc02.siu.domain_siu-SRVDC02-CA.crt
      ----------------  Certificate CDP  ----------------
      Verified "Base CRL (26)" Time: 0
        [0.0] http://sharepoint.siu.no:8088/siu-SRVDC02-CA.crl
      ----------------  Base CRL CDP  ----------------
      No URLs "None" Time: 0
      ----------------  Certificate OCSP  ----------------
      No URLs "None" Time: 0
        CRL 26:
        Issuer: CN=siu-SRVDC02-CA, DC=siu, DC=domain
        ThisUpdate: 19.03.2015 11:10
        NextUpdate: 15.09.2015 23:30
        e2ee543a68214f9b99dda2e9f58b1ddfc34429d1
    CertContext[0][1]: dwInfoStatus=10c dwErrorStatus=0
      Issuer: CN=siu-SRVDC02-CA, DC=siu, DC=domain
      NotBefore: 23.09.2011 13:00
      NotAfter: 23.09.2021 13:10
      Subject: CN=siu-SRVDC02-CA, DC=siu, DC=domain
      Serial: 60fc459ebdefa5b646a081b0c21c259d
      4ea8bb95b0038c69a83c939e8a54f892cd0b5056
      Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
      Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
      Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
      ----------------  Certificate AIA  ----------------
      No URLs "None" Time: 0
      ----------------  Certificate CDP  ----------------
      No URLs "None" Time: 0
      ----------------  Certificate OCSP  ----------------
      No URLs "None" Time: 0
    Exclude leaf cert:
      691f7e42f5c4a86d03b7225bf7303369ef6dcc7e
    Full chain:
      17e5b9477a1736c33dc0ff245e7b06de5b958c4c
    Verified Issuance Policies: None
    Verified Application Policies: All
    Cert is a CA certificate
    Leaf certificate revocation check passed
    CertUtil: -verify command completed successfully.
    Any clue?

    It looks like it is trying to get the CRL using LDAP. It is quite strange since no ldap entry is on the subordinate CA,
    only an HTTP address:
              <CertificateRevocationList location="TvoCache" url="ldap:///CN=siu-SRVDC02-CA,CN=srvdc02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=siu,DC=domain?certificateRevocationList?base?objectClass=cRLDistributionPoint"
    fileRef="DEEB557897A9FEA217DF83D95BF24CA54051B1CF.crl" issuerName="siu-SRVDC02-CA" />
                <CertificateRevocationList deltaCRL="true" location="TvoCache" url="ldap:///CN=siu-SRVDC02-CA,CN=srvdc02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=siu,DC=domain?deltaRevocationList?base?objectClass=cRLDistributionPoint" 
    I have checked that object using adsi Edit and the permissions seem ok. Also there is a value on both attributes: certificateRevocationList and deltaRevocationList.
    This problem happened after I removed the LDAP entry for the "CRL Distribution point" from the sub CA properties. Should I add back the LDAP entry?
    Log Name:      Microsoft-Windows-CAPI2/Operational
    Source:        Microsoft-Windows-CAPI2
    Date:          19.03.2015 14:42:07
    Event ID:      11
    Task Category: Build Chain
    Level:         Error
    Keywords:      Path Discovery,Path Validation
    User:          SYSTEM
    Computer:      srvdc01.siu.domain
    Description:
    For more details for this event, please refer to the "Details" section
    Event Xml:
    <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
      <System>
        <Provider Name="Microsoft-Windows-CAPI2" Guid="{5bbca4a8-b209-48dc-a8c7-b23d3e5216fb}" />
        <EventID>11</EventID>
        <Version>0</Version>
        <Level>2</Level>
        <Task>11</Task>
        <Opcode>2</Opcode>
        <Keywords>0x4000000000000003</Keywords>
        <TimeCreated SystemTime="2015-03-19T13:42:07.481533500Z" />
        <EventRecordID>131</EventRecordID>
        <Correlation />
        <Execution ProcessID="6288" ThreadID="5472" />
        <Channel>Microsoft-Windows-CAPI2/Operational</Channel>
        <Computer>srvdc01.siu.domain</Computer>
        <Security UserID="S-1-5-18" />
      </System>
      <UserData>
        <CertGetCertificateChain>
          <Certificate fileRef="E02AA2C59FD54241309B6EDA86B5C56454A9A8A1.cer" subjectName="siu-SRVDC01-CA" />
          <ExtendedKeyUsage />
          <Flags value="40000000" CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT="true" />
          <ChainEngineInfo context="machine" />
          <CertificateChain chainRef="{60B61582-1C3C-4B58-AE8C-70278ADEE402}" revocationFreshnessTime="P2DT21H13M20S">
            <TrustStatus>
              <ErrorStatus value="1000040" CERT_TRUST_REVOCATION_STATUS_UNKNOWN="true" CERT_TRUST_IS_OFFLINE_REVOCATION="true" />
              <InfoStatus value="100" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />
            </TrustStatus>
            <ChainElement>
              <Certificate fileRef="E02AA2C59FD54241309B6EDA86B5C56454A9A8A1.cer" subjectName="siu-SRVDC01-CA" />
              <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />
              <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />
              <TrustStatus>
                <ErrorStatus value="1000040" CERT_TRUST_REVOCATION_STATUS_UNKNOWN="true" CERT_TRUST_IS_OFFLINE_REVOCATION="true" />
                <InfoStatus value="102" CERT_TRUST_HAS_KEY_MATCH_ISSUER="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />
              </TrustStatus>
              <ApplicationUsage any="true" />
              <IssuanceUsage />
              <RevocationInfo freshnessTime="P2DT21H13M20S">
                <RevocationResult value="80092013">The revocation function was unable to check revocation because the revocation server was offline.</RevocationResult>
                <StrongSignProperties signHash="RSA/SHA1" issuerPublicKeyLength="2048" />
                <DeltaStrongSignProperties signHash="RSA/SHA1" issuerPublicKeyLength="2048" />
                <CertificateRevocationList location="TvoCache" url="ldap:///CN=siu-SRVDC02-CA,CN=srvdc02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=siu,DC=domain?certificateRevocationList?base?objectClass=cRLDistributionPoint"
    fileRef="DEEB557897A9FEA217DF83D95BF24CA54051B1CF.crl" issuerName="siu-SRVDC02-CA" />
                <CertificateRevocationList deltaCRL="true" location="TvoCache" url="ldap:///CN=siu-SRVDC02-CA,CN=srvdc02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=siu,DC=domain?deltaRevocationList?base?objectClass=cRLDistributionPoint"
    fileRef="58A2CDBC7A238DDD76EEFEDE354A04596F5AED71.crl" issuerName="siu-SRVDC02-CA" />
              </RevocationInfo>
            </ChainElement>
            <ChainElement>
              <Certificate fileRef="56500BCD92F8548A9E933CA8698C03B095BBA84E.cer" subjectName="siu-SRVDC02-CA" />
              <SignatureAlgorithm oid="1.2.840.113549.1.1.5" hashName="SHA1" publicKeyName="RSA" />
              <PublicKeyAlgorithm oid="1.2.840.113549.1.1.1" publicKeyName="RSA" publicKeyLength="2048" />
              <TrustStatus>
                <ErrorStatus value="0" />
                <InfoStatus value="10C" CERT_TRUST_HAS_NAME_MATCH_ISSUER="true" CERT_TRUST_IS_SELF_SIGNED="true" CERT_TRUST_HAS_PREFERRED_ISSUER="true" />
              </TrustStatus>
              <ApplicationUsage any="true" />
              <IssuanceUsage any="true" />
            </ChainElement>
          </CertificateChain>
          <EventAuxInfo ProcessName="certsrv.exe" />
          <CorrelationAuxInfo TaskId="{54E4FCD3-E70A-4024-BB81-6A053EAACE21}" SeqNumber="9" />
          <Result value="80092013">The revocation function was unable to check revocation because the revocation server was offline.</Result>
        </CertGetCertificateChain>
      </UserData>
    </Event>

  • STS -HOW TO REMOVE OPEN PLANNING TAB

    Hi,
    when a subordinate sends his plan for approval in sts,the approver at higher level could see a open planning tab through which he is able to change what his subordinate has planned.
    how to remove that tab.
    any advice would be highly appreciated.
    thanks

    Unlock the Network preference pane, if necessary, by clicking the lock icon in the lower left corner and entering your password. Cllck Advanced, open the DNS tab, and delete the server addresses. Click OK and then Apply.

  • The affects of removing a certficate template from a Certificate Authority

    I have inherited what I am beginning to believe is a poorly designed PKI Infrastructure. I have 1 root CA and 2 Issuing CAs all 2008 R2. My root certificate authority is expiring in about 2 months so I am planning to renew it and the Subordinate CAs soon.
    I see that the root CA has issued a lot of certificates and that many templates are available. The root is not offline. (I know not best practice).
    I would like to remove these templates from the Root CA and allow the subordinates to do all the issuing. If I do this before I renew the Root CA then all the certs currently issued will expire in 2 months and not be renewed on the Root CA.
    My questions are:
    In the scenario above will the certificates originally issued by the Root CA be renewed on the Subordinate CAs?
    Most of these certs seem to be auto enrolled. Will Auto Enrollment know to go to the Subordinate CA from now on?
    Are there any other concerns with taking this action that I should be aware of?
    Most of the certificate templates on the Root CA are default templates and I believe are Auto Enrolled. (I haven’t manually issued certs for these templates)
    Basic EFS
    Computer (I know this one is auto enroll)
    Domain Controller

    First, you have to renew all CA certificates starting with root (down to hierarchy) before you proceed.
    > In the scenario above will the certificates originally issued by the Root CA be renewed on the Subordinate CAs?
    yes. Clients will use any enterprise CA that supports specified template.
    > Most of these certs seem to be auto enrolled. Will Auto Enrollment know to go to the Subordinate CA from now on?
    again, yes, see above.
    My weblog: http://en-us.sysadmins.lv
    PowerShell PKI Module: http://pspki.codeplex.com
    Check out new:
    PowerShell FCIV tool.

  • Question about Removing Permissions from the System Folder with chmod

    Hi
    I have a question about the removal of permissions from the System folder (and sub directories and files).
    Background
    Since installing a new HD, clean install of 10.6, application of updates and moving over backed up user directories I have had several issues with permissions.
    I have read several threads on this and using disk warrior and other tools I have been able to fix most of the issues.
    The Problem
    The issue that remains is a permissions check using Disk Utility keeps reporting
    ACL found but not expected on "System".
    followed by an extensive list of sub directories and all.
    Attempts to repair take hours and the same errors are reported.
    Found Solutions
    I have read about changing and/or completely removing the ACL from the permissions from the System using two different commands:
    sudo chmod -R -N ./System/* ( to remove all ACLs)
    or
    sudo chmod -R -E ./System/* ( to replace all ACLs )
    My Question is ( to the UNIX gurus):
    What is the difference between the usage with -E and -R and which is the best approach for a Systems directory and (subordinates)?
    Many thanks!!

    OK
    So I misread on the your instructions about the PW reset, did it, no harm in that. I did also select the options to reset all the permissions for all the accounts and the ACL issues were not resolved. My bad, I forgot to note that.
    You do suggest getting and expert opinion but alas these are rather elusive. In most cases the Apple solutions is to do a complete reinstall... I have found that unless you completely wipe a drive and rebuild everything there are often artifacts left behind. Since I have full and redundant back-ups I would rather explore and hack a little instead of a dull old system reinstall. The irony is the system issue I had was it was the result a reinstall and combo update on a new drive. I recognize the risks of entering the realms of the System folders but I am willing to explore knowing full well that I have a path to recovery.
    Thanks again for your insights. I come to the forums looking for insights and ideas but not a lecture...

  • Remove unwanted issues Root certificates

    Do some typos in my AIA and CDP ldap paths I had to re-issue a new certificate from my offline root three times.  So within the trusted root certificate authority on all my clients their are three root certificates which have been downloaded from
    the domain.  Two of the certificates have been superseded by the newest issued root certificate and is not needed. 
    Is there anyway to clean up these old root certificates? I want it so that newly joined domain machines only download the newest root certificate into the machine's root certificate authority.
    Thanks for everyone's help.
    Joel

    For an offline CA these certificates have been distributed either:
    by downloading them from Active Directory's config. container - if you have published them before with
    certutil -dspublish -f [Your Root CA].crt RootCA
    or via Group Policies - in this cases you have added them to a computer GPO before.
    In either case you could remove the CA certificates from clients by deleting them from the respective "central AD store" before:
    from AD config. container: Use pkiview.msc, right-click the top node,
    Manage AD Containers, Certification Authorities. View all three certificates and delete the two older ones. You need Enterprise Admins rights for this unless permissions have been delegated.
    from the GPO:
    Computer Configuration/Windows Settings/Security Settings/Public Key Policies/Trusted Root Certification Authorities
    Having deleted the CA certificates run gpupdate /force at the clients or wait (also in case of 1. the download is triggered by GPO refresh).
    Edit: But one thing that strikes me odd: A Root CA certificate should not contain any AIA or CDP URLs - so does your question really refer to the Root CA certificate itself or to a subordinate CA certificate signed by the Root CA?
    In case you mean three subordinate CA certificates distributed to the Intermediate CA store you could delete them from the AD AIA store with pkiview.msc as well.
    Elke

  • Error Level 10: I have this error where a plugin broke that I had to remove because it was not finding it. How do i install it back so it functions?

    8/29/2014 7:15am
    It seems to me that if Microsoft's platform can not fix it with the troubleshooter that the troubleshooter sucks.  It does not know when errors are thrown so your developer sucks on creating software for errors that are popping up in your software?
    if a error is thrown in Windows 8 it should catch it upon a thrown error in programming? This hsould be a level 1 ticket. Since when I call you support for error in your product no one wants to address problems in your software and get mea tech to resolve
    it?
    The question now is how do I fix this and why is it causing me an internal error 500 for my web server install?
    I may have other issues but I need access to my web server through my browser I used fsocketopen to troubleshoot it?
    It gets back a internal 500 on Gecko process in firefox and on IE it just won't serve out the document in my web server abyss or apache? So the question is what service is broken so I can't serve my [web server] pages out? Let me go through all the event
    logs that I have with errors below?
    Under Applications:
    1) Failure to load the application settings for package microsoft.windowscommunicationsapps_8wekyb3d8bbwe. Error Code: 10
    2) LMS Service cannot connect to Intel(R) MEI driver. Error level 1
    3) Failure to load the application settings for package microsoft.windowscommunicationsapps_8wekyb3d8bbwe. Error Code: 3
    4) SearchIndexer (3476) Windows: The database engine attached a database (1, C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb). (Time=0 seconds)
    5) Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.125, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000, [11] 0.000, [12] 0.000.
    Saved Cache: 1 0: Evenet Id level 326.
    6) SearchIndexer (3476) Windows: The database engine started a new instance (0). (Time=0 seconds)
    7) Internal Timing Sequence: [1] 0.000, [2] 0.000, [3] 0.000, [4] 0.000, [5] 0.000, [6] 0.000, [7] 0.000, [8] 0.000, [9] 0.000, [10] 0.000. eveent level 105
    8) SearchIndexer (3476) Windows: The database engine (6.03.9600.0000) is starting a new instance (0). Error Level 102
    Under Security:
    1) We might want to check this out here User Account Management changed?
    Under Setup: no errors.
    Under System below:
    1) Name resolution for the name win8.ipv6.microsoft.com. timed out after none of the configured DNS servers responded.Event level  1014
    2) Intel(R) 82567LM-3 Gigabit Network Connection
     Network link is disconnected.
    3) The system has returned from a low power state.
    Sleep Time: ‎2014‎-‎08‎-‎29T05:10:07.602701000Z
    Wake Time: ‎2014‎-‎08‎-‎29T13:13:47.945773100Z
    Wake Source: Device -USB Root Hub : Error level 1
    4) The browser has forced an election on network \Device\NetBT_Tcpip_{58565081-3013-43B6-AE07-CC89C71F6036} because a master browser was stopped. Event Id 8033.
    5) The driver \Driver\WudfRd failed to load for the device SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_EPSON&Prod_Storage&Rev_1.00#7&2d369789&0&533536503532383375&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}. Event error 219.
    6) The driver \Driver\WudfRd failed to load for the device SWD\WPDBUSENUM\{3c83e4cf-28e9-11e4-827b-b8ac6f8aec21}#0000000000004000. Error Level Id 219.
    7) The UMDF reflector was unable to complete startup because the WUDFPf service was not found.  This service may be started later during boot, at which point Windows will attempt to start the device again. Error Id 10114.
    8) Unable to bind to the underlying transport for [::]:80. The IP Listen-Only list may contain a reference to an interface which may not exist on this machine.  The data field contains the error number. Event Id 15005.
    9) The supersafer64 service failed to start due to the following error:
    The system cannot find the file specified. Event ID 7000.
    10) The SNMP Service encountered an error while accessing the registry key SYSTEM\CurrentControlSet\Services\SNMP\Parameters\TrapConfiguration. Error: 1500.
    11) The SAS Core Service service failed to start due to the following error:
    The system cannot find the file specified. 7000
    12 The World Wide Web Publishing Service (WWW Service) did not register the URL prefix http://*:80/ for site 1. The site has been disabled. The data field contains the error number. 1004
    13) The driver \Driver\WudfRd failed to load for the device SWD\WPDBUSENUM\_??_USBSTOR#Disk&Ven_EPSON&Prod_Storage&Rev_1.00#7&2d369789&0&533536503532383375&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}. Error level 219
    14) Name resolution for the name win8.ipv6.microsoft.com. timed out after none of the configured DNS servers responded. Error level 1014.
    Now I need help with all these error since Windows 8 with maybe 15 applications is failing after no setup errors? What would cause these we need to find out? Since I can not use your product with so many developer errors? and to put out a products that doesn
    work is pointless? So please call me and have some help me through the errors and tell your support to stop ignoring the errors that broke the products?
    Sincerely, William Dunlap {removed} N. Academy blvd, 201, Colorado Springs, CO 80910 http:\\interfacesone.fnhost.org
    {removed}.  I need a tech to help me get my web server up?

    So now you don't release the security breaches in windows 8. You mean to tell me that you can use Powershell - Using WMI to breach security in VB apps on the web by getting my file structures?
    What is this all about?
     1 Set VPN NIC Settings
        2 Get Network Data from servers
    Set VPN NIC Settings
    $error.clear | out-null
    cls
    $ErrorActionPreference = "SilentlyContinue"
    if ( $Args.Count -ne 1 ) { "
    Not enough arguments
    Usage :
        script.ps1 server
    "; exit }
    $server = $Args[0].ToLower()
    "We are working with $server"
    $netAdapt = get-wmiobject -class Win32_NetworkAdapter -computer $server
    if (!($netAdapt)) {  
        "Failed to connect to the target server!"
        exit(5)
    foreach ($card in $netAdapt) {
        IF (!([string]::IsNullOrEmpty($card.NetConnectionID))) {
            if ($card.NetConnectionID.CompareTo("VPN Virtual NIC") -eq 0) {
                $myID = $card.DeviceID
    $NAC = [wmi]"\\$server\root\cimv2:Win32_NetworkAdapterConfiguration.index='$myid'"
    $guid=$NAC.settingID
    "Setting DNS Toggles"
    $dnsToggle = $NAC.SetDynamicDNSRegistration(0,0)
    if ($dnsToggle) {
            "Success"
        } else {
            "Failure"
    $strShowNicKeyName = "SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\$guid\connection"
    #$strShowNicKeyName
    $reg = [Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey('LocalMachine', $server)
    $regKey= $reg.OpenSubKey("$strShowNicKeyName",$true)
    $showIcon = $regKey.GetValue("ShowIcon")
    if (!($showIcon -eq 1)) {
        "The icon is hidden.. Setting it now"
        $setIcon = $regKey.SetValue('ShowIcon',1,'DWORD')
       } else {
        "The icon is visible already."
    "Script Ends"
    Get Network Data from servers
    $myfile = get-content servers.txt
    echo "Server    IPs    Subnet    GW" | out-file "Results.txt" -Append
    foreach ($server in $myfile) {
        Write-Host "Looking at $server"
        $colitems = Get-WmiObject win32_NetworkAdapterConfiguration -computer "$server" -Filter 'IPEnabled = "True"' | select ipaddress,ipsubnet,index,defaultipgateway
        foreach($objItem in $colItems) {
        Write-Host ""
        $myip = $objItem.IPAddress -join " "
        $mySubnet = $objItem.IPSubnet  
        $myGW = $objItem.DefaultIPGateway
        $temp = $objItem.index
        $myid = Get-WmiObject win32_NetworkAdapter -computer "$server" -Filter "index = $temp" | select  netconnectionid
        $myid = $myid -replace "@{netconnectionid=",""
        $myid = $myid -Replace "}",""
        echo "$server    $myip    $mySubnet    $myGW    $myid"
        echo "$server    $myip    $mySubnet    $myGW    $myid"  | out-file "Results.txt" -Append
    Is this possible on any machine with power shell and if so how is access done?
    William Dunlap

  • Creating a backup of functional drive removed from broken laptop

    I have a new Macbook Pro running Mountain Lion that is damaged and won't turn on. I have the drive removed and can access it using a docking station attached to my iMac running 10.6.
    What is the simplest way to backup the data from this drive so that after the laptop is repaired I can return my data to the Macbook Pro?

    Using Disk Utility to clone a drive will automatically erase the Destination drive if it isn't already erased. To backup to a drive with stuff already on it you would need to use a backup utility like one of these:
    Suggested Backup Software
      1. Carbon Copy Cloner
      2. Data Backup
      3. Deja Vu
      4. SuperDuper!
      5. Synk Pro
      6. Tri-Backup
    Others may be found at VersionTracker or MacUpdate.
    Visit The XLab FAQs and read the FAQ on backup and restore.  Also read How to Back Up and Restore Your Files.
    Be sure the backup utility is NOT configured to erase all files on the destination that are not on the source. If there are files identical to those already on the drive, then they will be overwritten.

  • TS3989 My 5th gen ipod touch was stolen.  I removed the device from my iTunes account, but their pictures still show up on the photostream on the one I purchased to replace it.  How do I get this to stop, the cops have no interest in their faces, nor do I

    My 5th gen iPod touh was stolen a month ago.  I immediately removed that device from my account and yet today I looked at my photostream and there are tons of pics of these people on my photostream.  How do I get this to stop?!?

    Change your iCloud ID password: http://support.apple.com/kb/HT5624.  After doing so, go to Settings>iCloud, tap Delete Account, then sign back in with the new password.

  • Itunes match has removed my playlists from itunes and my iphone. Not only that, many of the songs 'matched' on itunes do not show up on my iphone. Seriously annoyed, wish I'd never paid for it

    Please read the title; itunes match has removed my playlists on itunes and iphone and the songs that are supposedly 'matched' on itunes are not showing up on my iphone.
    Any Really annoyed about this

    iTunes Match does not have the ability to remove local files.
    The service operates by comparing the selected iTunes Library with the iTunes Store content and 'matching' or 'uploading' - it is very straightforward a 'match' provides equivalent access to iTunes Store content as a recognised 'purchase'; upload simply copies a 256k AAC variant into the cloud.  There are no elements of this activity that can erase the local library content.
    Would suggest you explore possible alternative causes of file loss.  Given the pattern described of selective deletion, leaving many Songs intact - would suggest making at least 2 secure offline Song file backups and starting the library again from a fresh install of iTunes once a thorough sweep of the system has been completed for virus.  It is also worth assessing the physical security of the system - who has access & with what privileges.
    To access Songs from the cloud, you would have to manually delete the Song from the library or open an empty library - so even when accessing content, iTunes Match provides no local deletion capability.

  • Anyone know how to remove Overdrive books from my iphone that have been transferred from my computer? They do not show up on itunes. I see a lot of answers to this question but they all are based on being able to see the books in iTunes.

    How do I remove Overdrive books from the library that were downloaded onto my computer then transferred to my iphone? The problem is that they do not show up in iTunes.
    I see this question asked a lot when I google, but they always give answers that assumes you can find the books in iTunes either under the books tab, or the audio books tab or in the music. They do not show up anywhere for me. They do not remove from the app like the ones I downloaded directly onto my iphone.the related archived article does not answer it either.  I even asked a guy working at an apple store and he could not help either.   Anybody...?
    Thanks!

    there is an app called daisydisk on mac app store which will help you see exactly where the memory is focused and consumed try using that app and see which folders are using more memory

  • Firefox hangs on opening requiring force quit I have snow leopard mac It hangs when I try safe mode. I need to know how to remove all traces of firefox on my mac so I can reinstall. I have tried terminal as advised on firefox webpage. Please advise m

    Firefox hangs on opening requiring force quit I have snow leopard Mac It even hangs when I try safe mode. I need to know how to remove all traces of firefox on my mac so I can reinstall. I have tried terminal as advised on firefox webpage. Please advise me
    == This happened ==
    Every time Firefox opened
    == I tried to update firefox add-ons ==
    == User Agent ==
    Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us) AppleWebKit/531.22.7 (KHTML, like Gecko) Version/4.0.5 Safari/531.22.7

    Try a new profile. See [[Recovering important data from an old profile]]

Maybe you are looking for

  • How to do it?  Alternate readLine(), read bytes?

    Problem: How to alternate between an InputStreamReader and a raw InputStream when reading data from an InputStream. The catch is that the InputStreamReader may read ahead a few bytes and so subsequent reading from the underlying InputStream will miss

  • XSLT Maps with Java enhancements - JCO_SYSTEM_FAILURE

    Hi, I have reviewed several postings regarding XSLT Maps with Java enhancements. I followed instructions and build a jar file and the XSLT document. I built one imported archive with the .jar and .xsl. For the class, The path get loaded properly. How

  • ** Use of 3 values in 'Receiver From' property of the BPM send step

    Hi Friends, Still I am not clear the exact use of 'Receiver From' property of the Send step in BPM. This property is having 3 possible values: 'Send Context', 'Receivers List', & 'Response to Message'. What's the purpose of each value ? In what situa

  • Problems with a card binding.

    Hello, I had a problem with a VISA CLASSIC card binding (Money on the account is). When I try to buy or download the appendix, jumps out a window with control of editing of the card: There was a problem with drawing of the account for the previous pu

  • Help with Camera (Built-In)

    Hellow everyone, I have a Imac and the camera light is green but noting is showing up on my screen on a webcam site, does anyone know how to fix this?