Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
13,726 questions
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. corp-SRV-CA Keyset does not exist 0x80090016 (-2146893802 NTE_BAD_KEYSET).
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 8%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EG%3C/text%3E%3C/svg%3E)
godzillaKP
66
Reputation points
Hello everyone,
After a OS restart to install updates, the OS shown the watermark of "Windows not activated". At first tried to fix it through Windows activation troubleshooting, but was not possible:
On Windows Server console, we also noticed that Active Directory Certificate Services was not started, and looking at Event Viewer, there was the message:
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. corp-SRV-CA Keyset does not exist 0x80090016 (-2146893802 NTE_BAD_KEYSET).
Seems like key is no longer available for this CA, and that leads to ADCS to not start.
As a test attempt, to see if it was during last restart, tried to restore a previous machine state on a test VM, and also noticed that this was already missing before last reboot.
On test VM tried to remove and install ADCS again, but when trying to install it, I got a message with an error 8007371c.
Tried after on test VM, DISM and SFC, but still ADCS was giving the same error while installing it.
Any of you know how can I solve this?
Thank you.
{count} votes
-
godzillaKP 66 Reputation points
2023-03-10T11:34:06.7233333+00:00 I don't know if I can simply renew this certificate with a new pair of keys, and what do I need to setup next, in order to be able to start ADCS service.
-
godzillaKP 66 Reputation points
2023-03-10T15:52:53.9666667+00:00 After a while, we were able to fix that CA cert by renewing it with a new pair of keys, and Windows Activate, on both there was missing folders (don't know why), and we have discovered this while comparing with another server that we have.
Now we were able to discover that we were also getting the 8007371c error for windows updates (when they fail to install), not just when we tried to install ADCS role:
Installation Failure: Windows failed to install the following update with error 0x8007371C: 2023-02 Cumulative Update for Windows Server 2016 for x64-based Systems (KB5022838).
Sign in to comment
1 answer
Sort by: Most helpful
-
Deleted
This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Comments have been turned off. Learn more