What are the ramifications of removing a Windows PKI?

I inherited a Windows domain with a PKI configured. To the best I can determine, it appears it was set up with the goal of enabling encryption on a file server but that it was never enforced and that file server has since been replaced.

I'd like to remove the PKI because it doesn't appear that we're using it and it's messing up some third party certs installed on a couple of domain controllers used for LDAP authentication for cloud services.

What possible/likely consequences are there of removing it (assuming that I follow the articles for removing it)?



If some form of PKI services are installed, it may be running Cert authority services or used to issue cert to other station or server, good to make this is not the intent and the server is not having a CA role. The certificate store will be archiving all certificate and it is good to backup all including private key in case there is need for them due to EFS or other services unknown at the point of removal. Of course ideally it is to clone another HDD before changes make and safekeep for monitoring as backup recovery if need to..also the security log from security event to backup for audit trail...but "PKI" is a big word though for a server may be just part of the PKI ecosystem

In case the below are relevant
How to decommission a Windows enterprise certification authority and remove all related objects



If some form of PKI services are installed, it may be running Cert authority services or used to issue cert to other station or server, good to make this is not the intent and the server is not having a CA role. The certificate store will be archiving all certificate and it is good to backup all including private key in case there is need for them due to EFS or other services unknown at the point of removal. Of course ideally it is to clone another HDD before changes make and safekeep for monitoring as backup recovery if need to..also the security log from security event to backup for audit trail...but "PKI" is a big word though for a server may be just part of the PKI ecosystem

In case the below are relevant
How to decommission a Windows enterprise certification authority and remove all related objects



Thanks, this gives me more of an idea to look for what it may affect.







Share this

Related Posts

There was an error in this gadget