Windows 10: Demote Domain Controller blocked by Certificate

Moving 2012r2 Domain Controllers DC1 to new 2016 Domain Controllers DC01.Roles for DNS & DHCP are already removed and now trying to remove ADDC1 has Active Directory Certificate Services Role blocking me from Demoting the ServerHow do I proceed to move Schema Master and Domain Naming Master to Windows 2016 DC01Microsoft Windows [Version 6.3.9600] c 2013 Microsoft Corporation. All rights reserved. C:\Windows\system32>netdom query fsmo Schema master DC1.mtc.mansion.rosewoodhotels.local Domain naming master DC1.mtc.mansion.rosewoodhotels.local PDC

:)

 

self signed certificate expired in domain controller, please call us

• the self signed certificate expired in domain controller, please call us

 

Error when try to enroll a certificate

The RPC service is used to communicate with other services and servers on the network, and if it is not running or is configured incorrectly, it can cause issues like the one you're experiencing.

Possible causes for this error include:

• The RPC service is not running on the certificate server.
  
• A firewall is blocking RPC traffic.
  
• The certificate server is not configured to use the correct network settings.
  
• There is a problem with the domain controller that is preventing the certificate server from communicating with it.
  

To troubleshoot this issue, you can try the following steps:

• Check that the RPC service is running on the certificate server.
  
• Check the firewall settings to ensure that they are not blocking RPC traffic.
  
• Check the network settings on the certificate server to ensure that they are correct.
  
• Check the domain controller to ensure that it is online and that there are no issues with it that may be causing the problem.
  

 

BOINC for Windows Domain Controllers

Long story short, BOINC stopped supporting domain controllers after version 5.10.45 and 5.10.45 broke because it's HTTPS security certificates are out of date. Requirements:

• Windows Server 2003 R2 x64 Edition or newer (must be 64-bit)
• Must have domain controller role installed.

If neither of these requirements are met, just use the latest version from Berkeley.

The solution:

• Download this ZIP from TPU (thanks @Wizzard!)
• Extract everything from the ZIP to the desktop or some place you can easily access it.
• Run "boinc_5.10.45_windows_x86_64.exe" to install 5.10.45 as normal.
• After it is installed, make sure BOINC is not running. If it is running as a service, you can stop it via Services. If it is running in the tray, right click on the tray icon and click on Exit.
• Navigate to where BOINC is installed. This is usually C:\Program Files\BOINC. You should see a ca-bundle.crt file here (it'll have a different icon from the rest). If you do, you're in the right place.
• Extract the contents of the "certificates" folder to the folder where BOINC is installed. You should be prompted to replace existing files. Do it. If you do not, you're likely in the wrong directory or copied the "certificates" folder instead of its contents. It is very important that the files inside of "certificates" overwrite the installed BOINC files.
• Start BOINC again. If it is a service, go back into Services and start the BOINC service. If it is a tray application, run it from your start menu. You'll also need to start the BOINC Manager if you have it installed as a service for the next step.
• Double click on the tray icon to open the BOINC Manager if it isn't already open. Click on the "Messages" tab and verify it is able to download tasks. If it is, you're good to go. If you see "SSL connect" errors lets us know by replying to the thread.

The "certificates" are copied from 7.6.22.