Paul
Wed Nov 02 02:23:15 CST 2005
In article <80E88F04-0F09-4052-9EAF-4AF8133E3C7B@microsoft.com>, in the
microsoft.public.security news group, =?Utf-8?B?bGJjYmVu?=
<lbcben@discussions.microsoft.com> says...
> Hi,
>
> There's nothing wrong with my domain controller, so does it mean that by
> performing Sub CA backup using CA snap-in, is sufficient enough.
You only have one domain controller? That's not a good idea even if you
weren't using Certificate Services. You should be performing a system
state backup of your domain controller in addition to your CA backups.
See my other response for backing up the templates independently of AD.
>
> I'm confusing between using CA snap-in to backup private key AND using
> saving registry setting by exporting
> HKEY_LOCAL MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration
>
> For normal CA snap-in, I ticked Private Keys, CA Certificate Issued Log and
> Pending Requests, then I perform registry exporting.
>
> Am I doing double work?..or actually, I just use CA snap-in backup will do?
No, you're on the right track. Backing up the CA database and private
key through the MMC does not back up the CA registry entries.
You should also be performing a system state backup of your CA which
includes Certificate Services.
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/S
erverHelp/b70185ed-93aa-4346-b869-9913282086af.mspx
or
http://tinyurl.com/7az4a
--
Paul Adare
MVP - Windows - Virtual Machine
http://www.identit.ca/blogs/paul/
"The English language, complete with irony, satire, and sarcasm, has
survived for centuries without smileys. Only the new crop of modern
computer geeks finds it impossible to detect a joke that is not clearly
labeled as such."
Ray Shea