Moving an Enterprise Root CA

[jrcanfer]

I need to retire an old win2k server which is our Enterprise Root CA.

The rest of our core infrastructure is moving over to Win2003 or already is Win2003.

Is there any way of making one of our Win2003 Servers the Enterprise Root CA - i.e. moving the role across to it without totally screwing up the domain security?

From what I've read the only real option is to build up a second server offline with the same name, copy over the certs from a backup, then retire the first server and bring the second online.

Are there any other options open to me?

Many thanks

 

[danjwalker]

That way is the safest. I would do that unless you want problems.

If you are stuck for hardware, do it twice. Once to a crappy machine, then again to the original server.

 

[markdmac]

http://support.microsoft.com/default.aspx?scid=kb;en-us;298138

I hope you find this post helpful.

Regards,

Mark