Event ID 1093 and a pretty weird certificate problem

Question

While going thru some logs recently, I came across Event ID 1093, and that I have an AD object that exceeds the maximum object record size.

The offending AD object is a domain controller I had issues with a week or so ago that required me to demote it, remove it from the domain, and start over again. At any rate, it appears that over that period it accumulated over 1000 certificates from our CA. The CA only lists about 20 certs as being issued (there probably should only be 4, but that's a problem for another day), so I'm thinking these are stale from when I removed and put back this DC?? You'd think that the CA would still list these hundreds of certs as having been issued, but nope. I know that the CA allegedly issued these certs as its authority key identifier is all over the issued certs. Is there a safe way to remove these extra certs from the AD object?

Thanks!

Answer 1

So.... is it safe for me to just delete everything out of "userCertificate" if I back up the actual certificates on the DC? Do I just remove the extra data out of that attribute? And if so, how do I know which ones are the 4 valid ones? Kinda hard to parse all those octets, and I can't really do a search (using the Attribute Editor) to match up the data in the attribute with the signature from the cert(s). I'm not sure which octets relate to what.