Windows 2000 Enterprise CAs Not Added to Certificate Publishers Group in Windows Server 2003 Domain

View products that this article applies to.

This article was previously published under Q300532

Expand all | Collapse all

SYMPTOMS

After you add Enterprise Certification Authority (CA) functionality to a Windows 2000 Server-based computer in a Windows Server 2003 domain, the Windows 2000 CA may not be able to publish certificates to the Active Directory. The following error entry may also appear in the Application Event log:

Event Type: Warning
Event Source: CertSvc
Event Category: None
Event ID: 80
Date: date
Time: time
User: N/A
Computer: CA01
Description:

Certificate Services could not publish a Certificate for request 49546 to the following location on server DC02.example.microsoft.com: CN=Test,OU=Users,DC=example,DC=microsoft,DC=com. The administrative limit for this request was exceeded. 0x80072024 (WIN32: 8228). ldap: 0xb: 00002024: SvcErr: DSID-02050ABE, problem 5008 (ADMIN_LIMIT_EXCEEDED), data -1026

For more information, see Help and Support Center at http://search.support.microsoft.com/search/?adv=1.

Back to the top

CAUSE

Windows 2000 Enterprise CAs are not automatically added to the Certificate Publishers group in a Windows Server 2003 domain.

Back to the top

RESOLUTION

Manually add the computer account for the Windows 2000 CA to the Certificate Publishers group in the root domain of the forest:

Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
Double-click the domain name in the left-side pane.
Double-click the Users container.
Double-click the Cert Publishers group in the right-side pane.
Click the Members tab, and then click Add.
Browse to the name of the computer that is hosting the CA (or type this name), and then click OK.