Forum Discussion
Removal of old CA server stale data
Thanks for the details. certutil -dsdelca is not a valid command; the supported command is certutil -dsDel [CommonName].
However, I would not start by deleting the objects directly in ADSI Edit. First confirm how the old root certificate is reaching devices. Check an affected machine with certutil -store Root, note the certificate thumbprint, and then review your domain GPOs under Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities. If the certificate is deployed by GPO, removing the AD CS objects alone will not remove it from clients.
Once the certificate’s distribution source has been removed, use certutil -ds "CA Common Name" to list the related AD objects. After confirming that the old CA is no longer needed for certificate validation, EFS recovery, smart-card logon, or another service, remove only the matching stale entries with certutil -dsDel "CA Common Name" where appropriate.
ADSI Edit is best kept as a last resort for a specific object that remains after the supported cleanup. Take a System State backup first, test the removal on a small number of devices, and verify that the old root certificate is no longer present after policy refresh.
Thanks for the details. certutil -dsdelca is not a valid command; the supported command is certutil -dsDel [CommonName].
However, I would not start by deleting the objects directly in ADSI Edit. First confirm how the old root certificate is reaching devices. Check an affected machine with certutil -store Root, note the certificate thumbprint, and then review your domain GPOs under Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities. If the certificate is deployed by GPO, removing the AD CS objects alone will not remove it from clients.
Once the certificate’s distribution source has been removed, use certutil -ds "CA Common Name" to list the related AD objects. After confirming that the old CA is no longer needed for certificate validation, EFS recovery, smart-card logon, or another service, remove only the matching stale entries with certutil -dsDel "CA Common Name" where appropriate.
ADSI Edit is best kept as a last resort for a specific object that remains after the supported cleanup. Take a System State backup first, test the removal on a small number of devices, and verify that the old root certificate is no longer present after policy refresh.