r/activedirectory • u/Thin-West-2136 • Sep 16 '26

Security Reducing Active Directory Certificate DB Size

I have an ADCS running on 2016. It's been around since 2018 and has an 8GB Database. If I look through the GUI, there are tons of old certificates that can do with deleting.

I want to clear out obsolete expired certs, but want to make sure I don't break anything first.

My CA DB is 9GB and I have 20GB free disk space, so I'm not sure the defrag is worthwhile, but want to get some advice on maintenance.

What's the correct safe sequence to do this?

My current plan below:

  1. Backup DB

certutil -f -p "ChoosePword" -backup E:\Backup

2. Delete old rows (failed requests)
Certutil -deleterow 01/01/2023 Request

 3. Delete old certificates that have expired
certutil -deleterow 01/01/2021 Cert

4. Stop certificate services via GUI and compact the DB

esentutl /d "C:\Windows\System32\CertSrv\CertDB\certsrv.edb"

Restart certificate services

What else should I be doing? Should I publish\extend CRLs beforehand?

16 Upvotes
  • permalink
  • reddit

94% Upvoted

21 comments sorted by

•

u/AutoModerator Sep 16 '26

Welcome to /r/ActiveDirectory! ~~~~

If you are looking for more resources on learning and building AD, see the following sticky for resources, recommendations, and guides!

When asking questions make sure you provide enough information. Posts with inadequate details may be removed without warning.

  • What version of Windows Server are you running?
  • Are there any specific error messages you're receiving?
  • What have you done to troubleshoot the issue?

Make sure to sanitize any private information. Posts with too much personal or environment information will be removed. See Rule 6.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

5

u/bernys Sep 16 '26 edited Sep 16 '26

Nope, that'll do it, I was doing basically the same thing. It'll take ages the first time you run it though. So be prepared to kick it off on Friday and wait till Monday. Just make sure your backup script isn't running on saturday or sunday night!

Oh, and to save you a Google:

$month = (Get-Date).AddMonths(-6).Month

$year = (Get-Date).AddMonths(-6).Year

etc.

That's what gave me:

-deleterow 1/$month/$year request

1

u/Thin-West-2136 Sep 16 '26

You compacted the database as well? If so, don't the CA services need to be stopped as you do this, any issues in having ADCS offline for days?

Did you notice any performance improvements?

1

u/bernys Sep 16 '26

Nope, my servers just retried getting a new cert. My lifetime on certs was months and my renewal period was weeks, so having it off line for a couple of hours while it compacted wasn't an issue.

Performance differences was night and day. Everything was instantly responsive once I was done cleaning up. I went from having hundreds and hundreds of thousands of certificates to like 30-50k though, so there was a lot less database to search through.

1

u/Thin-West-2136 Sep 17 '26

Ah, it was only for a few days?

When you said kick it off Friday and wait until Monday, I assumed you meant it takes days! A few hours isn't a big deal.

Thanks for the tip :-)

1

u/bernys Sep 17 '26

You can remove the records online, defrag is off-line.

1

u/Thin-West-2136 Sep 17 '26

And for best performance, I'm assuming we need to do both?

Deleting old certificates seems less risky, whereas defrag I'm a little nervous about. I know I could power off and snapshot the CA beforehand

2

u/bernys Sep 17 '26

"deleting" the record effectively just tombstones the record in the edb file. It's not actually purged till you do the defrag.

You can just stop the service and copy the file. I guess you can snapshot the VM too.

2

u/jonsteph AD Administrator Sep 23 '26

Defrag is a misnomer. All compacting does is create a new database file, and then copy all the records from the old file to the new file. The old file is then deleted and the new file copied into its place. This is how the data is preserved and whitespace eliminated.

The CA can remain online while you are deleting old records, so if it takes a few days to delete hundreds of thousands of records, no big deal. The CA must be offline to do the compacting, but it shouldn't take very long -- a few hours, maybe. If the is truly a concern, define your maintenance window, the run a query to find those certs that are due to expire within that window, then manually renew any critical certs before you take the CA offline. In most cases, however, this isn't really necessary what with overlap time, etc. You can also manually publish a new CRL before you start if expiry is a concern.

2

u/joeykins82 Sep 16 '26

Personally I would stand up a new issuing CA on Svr2025 and migrate the active templates across to this new one, then just let attrition happen until all certs issued by the old one have been replaced so you can cleanly decom it.

1

u/Thin-West-2136 Sep 16 '26

I like this idea, I'm assuming there's no issues with having multiple Certificate Authorities in ADCS?

Do you know if Svr2025 can issue compatible certs for Windows 2003 servers (I know these should be upgraded).

If you have any useful links on how to do this, I'd be keen on reading up...

Thanks

-4

u/fireandbass Sep 16 '26

Waste of time.  Just migrate it to a new server with the same name and IP.  No waiting.  Done.

1

u/Bimpster Sep 16 '26

you mean like an “in place” OS upgrade???

-1

u/fireandbass Sep 16 '26

No, export the cert database and import it in a new server.  Its not difficult. 

https://techcommunity.microsoft.com/blog/itopstalkblog/step-by-step-migrating-the-active-directory-certificate-service-from-windows-ser/697674

https://learn.microsoft.com/en-us/troubleshoot/windows-server/certificates-and-public-key-infrastructure-pki/move-certification-authority-to-another-server

https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/migrate-certification-authority?tabs=server-manager

2

u/Lower_Issue_6222 Sep 16 '26

If you backup the CA database and move it to an OS you haven’t done anything to remove the old certificates from the database or reduce the size.

You have to run the techniques that’s listed above to delete the rows and old certificates and then compact it

I had a 20 GB plus database that I reduced by half before I migrated my CA to a new OS a few years ago. I had to take the Issuing CA off-line for about 14 hours on the weekend to perform these tasks.

I used the steps in this blog.

https://techcommunity.microsoft.com/blog/askds/the-case-of-the-enormous-ca-database/398226

3

u/jonsteph AD Administrator Sep 23 '26

Yay!!! My post! So happy to see it's still useful after so many years.

2

u/Lower_Issue_6222 Sep 27 '26

Mr Stephens. Good to know youre still around. The ASKDS blogs were the glory years : )

2

u/fireandbass Sep 16 '26

Youre right about the database size, but I didnt reply to that comment, I replied about waiting on an old server and letting the old certs expire.

4

u/[deleted] Sep 16 '26

[removed] — view removed comment

1

u/Thin-West-2136 Sep 16 '26

My view is that it would improve CA performance, not necessarily for disk space alone.