Slow starting Domain Controller after installing Enterprise Certificate Authority in Windows 2008 R2
Because I want to test SSL in the local domain I've installed Enterprise Certificate Authority with the use of this tutorial.
The Install went successful and after install I rebooted the DC. While starting up it takes a long time to get past the "Setting User Settings" information screen and when I look in Server Manager after start-up I see al sorts of warnings because of the delay and one error in CA:
ID: 91 - Could not connect to the Active Directory. Active Directory Certificate Services will retry when processing requires Active Directory access.
Does anyone understand what I could have missed what's causing the start-up delay now? Any tips for troubleshooting this are appreciated.
More info: I just followed all tips in this article. Everything was fine but in the "Confirm permissions on essential AD DS containers and objects" part I'm missing 2 folders they mention in the public key services node:
- NTAuthCertificates object
- Domain Computers and Domain Users containers.
Not sure if this is a problem just thought I mention it.
Again more info: I found another warning: The WinRM service failed to create the following SPNs
I fixed this in ADSIEDIT.MSC by giving the Network Service the correct rights on the CN. After this the server started faster. (have to reboot more and try to fix more warnings)
Another edit: Did one more reboot and the delay is back so the SPN fix didn't fix the slow start problem
Another Edit: Starting the advice to build a secondary DC/DNS server to see if it helps for the slow start-up. The good news it will help for sure for many other things!
Last Edit! Ryan's advice was SPOT on! Adding the second DC/DNS server made this problem go away at once!
Well, given the information that you posted gives me the hint that the DC is trying to access Active Directory during boot, but it can't because it is the only DC so Active Directory has not started yet. I would bet money that the issues goes away if you add another DC to the domain.
The WinRM error is just a side-effect... again, it is unable to register an SPN because Active Directory is required to register an SPN, and Active Directory is not ready yet.