Forum Discussion

ben_2's avatar
ben_2
Tin Contributor
Aug 04, 2026

Removal of old CA server stale data

Hi,

 

I'm rebuilding some DC's and figured I'd tidy everything up before doing so as I've come into this with a messy environment. from this, I found an old Trusted Root CA, the certificate authority server was decommissioned in 2021 and all certificates have had an expiry date from 2021. its still being pushed out to domain devices such as servers and desktops. I tried running the 'certutil -dsdelca' command however this comes back with invalid command. 

I guess the best option is just to remove the class objects from the ADSI edit?

as there is a class in AIA, CDP, Certification Authorities, KRA with the certificate name

 

 

Active Directory
certificate
Certification Authority
Root CA
windows server

1 Reply

  • NathanReed's avatar
    NathanReed
    Copper Contributor
    Aug 04, 2026

    Thanks for the details. certutil -dsdelca is not a valid command; the supported command is certutil -dsDel [CommonName].

    However, I would not start by deleting the objects directly in ADSI Edit. First confirm how the old root certificate is reaching devices. Check an affected machine with certutil -store Root, note the certificate thumbprint, and then review your domain GPOs under Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities. If the certificate is deployed by GPO, removing the AD CS objects alone will not remove it from clients.

    Once the certificate’s distribution source has been removed, use certutil -ds "CA Common Name" to list the related AD objects. After confirming that the old CA is no longer needed for certificate validation, EFS recovery, smart-card logon, or another service, remove only the matching stale entries with certutil -dsDel "CA Common Name" where appropriate.

    ADSI Edit is best kept as a last resort for a specific object that remains after the supported cleanup. Take a System State backup first, test the removal on a small number of devices, and verify that the old root certificate is no longer present after policy refresh.