This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 52%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
Hi,
We have a domain controller Windows server 2012 R2 that has Certification Authority Role on it and want to demote the server. This DC and CA is no longer needed. The CA role was installed almost a year back on this DC. I don't think the CA is in use. There are a few certificates listed in Issued Certificates folder though. Just need to understand if there will be any impact if I simply remove the CA role and demote the domain controller to a member server? We have another 2 domain controllers in the environment.
You can follow along here.
https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/decommission-enterprise-certification-authority-and-remove-objects
--please don't forget to upvote and Accept as answer if the reply is helpful--
Do I need to follow all the steps? Can I not remove the CA role directly and demote the DC?
Yes, I'd follow all the steps.
--please don't forget to upvote and Accept as answer if the reply is helpful--
Following the steps of CA removal won't have any impact on domain controller functionality right? I should be able to demote this DC smoothly post CA removal?
Yes, that's correct.
Just checking if there's any progress or updates?
--please don't forget to upvote and Accept as answer if the reply is helpful--
Thanks Patrick, I will be doing this today. Will post an update accordingly.
Ok, sounds good.
Hi Patrick,
Thanks for your prompt responses. I was able to successfully decommission CA by following the steps provided in the article followed by demoting the DC.
Great news! You're welcome.
Hi
As DSPatrick mentioned, it totally recommended to follow all the steps even if is possible to just delete the VM or reinstall the server and execute a clean-up process on Active Directory. The Certificate Authority configuration will remain and could generate some issues or bad experience in the future.
Before removing the CA role please ensure that is really no longer needed and take a backup.
- Check the the Issued Certificates folder at Certificate Authority admin console, probably there are some certificates related to production services that could be impacted.
- In the Certification Authority admin console, right-click the CA name, click All Tasks, and then click Back up CA to start the Certification Authority Backup Wizard. Then click Next, and then click Private key and CA certificate as well as the Certificate database and certificate database log.