Removing a Certificate Authority from a domain when the physical server no longer exists

Question

So I have two certificate authorities in a domain that I inherited that were set up on servers that have been taken out of service years ago, so I am not able to do the proper CA uninstall. I get constant errors on my DCs referencing certificate autoenrollement
errors associated with these non-existent CAs (listed below). What is the proper way to remove these CAs from AD and how can I be sure that no certificates they generated are used?  I see that the certs in the DC stores generated by the
CAs in question all expired last year, and that hasn't seemed to have caused a problem.
DC errors referencing abandoned CAs:
Event ID 6:  Automatic certificate enrollment failed, the RPC Server is Unavailable
Event ID 13:  Certificate enrollment for Local system failed to enroll for a DomainController certificate with request ID N/A from OLDCA
Event ID 82:  Certificate enrollment for Local system failed in authentication to all urls for enrollment server associated with policy id: {GUID} (The RPC server is unavailable. 0x800706ba (WIN32: 1722)). Failed to enroll for template: DomainController
 

Answer 1

There is no definitive way to know for sure, but you could do a little checking. If the there is no valid CRL (expired or none existent) then most likely all of the certificates in the environment are unusable. You can use this command to view the CRLs in
AD. Replaced the DC=XXX with your AD distinguished name.
Certutil -viewstore "ldap:///CN=CAName,CN=MachineName,CN=CDP,CN=Public Key Services,CN=Services,CN=Configuration,DC=XXX,DC=XXX?certificateRevocationList?base?objectClass=cRLDistributionPoint"
Also, if you are still uncertain, you can remove the objects from the Enrollment Services container (CN=Configuration,CN=Services,CN=Public Key Services). That will make it appear that there is no CA available and the enrollment messages will go away you
are seeing. But anything else that may or may not be using a certificate will be unaffected.
Mark B. Cooper, President and Founder of PKI Solutions Inc., former Microsoft Senior Engineer and subject matter expert for Microsoft Active Directory Certificate Services (ADCS). Known as “The PKI Guy” at Microsoft for 10 years.