Remove expired CA certificates

A root CA can easily be made an enterprise CA because that's the deployment that makes sense in some scenarios. A lot of deployments don't want or need an offline standalone root, or any intermediates at all; those can work just fine with an enterprise root. Say, for instance, if you're not issuing more than a couple of long-lived templates (so availability isn't a huge concern) and don't need to publish CRLs often.

I'm right there with you on it being a little too easy to just toss up a poorly planned CA - you develop an appreciation for how carefully they should be planned after reviewing the documentation, but it's not obvious when you're doing the install (and don't get me started on the simultaneous necessity and obscurity of capolicy.inf - put that stuff in the GUI!).

I've dealt with cleaning up these half-baked deployements more than I'd care to admit, but pulling them down is definitely doable (make sure all clients trust the new root, strip the templates from the old CA, bump the template version to force a re-enroll against the new CA); it just requires much more work and careful planning than was put into the initial sloppy deployment.

turns out the standalone CA scenario was causing the issue. The renewal and certificate request process built into the certificate MMC GUI requires a policy web server (which can't run on a standalone CA as it requires domain permissions to install).

As a result, you need to manually remove, request and accept the new certs. Found a blog post that details instructions on how to do it manually using certutil.

http://blogs.technet.com/b/askds/archive/2008/04/28/configuring-network-device-enrollment-service-for-windows-server-2008-with-custom-certificates.aspx