Explanation/Reference:
Explanation:
A. ADCS needs to be backup up using certutil
B. -Backup, -backupdb, -backupKey:
You can use Certutil.exe to dump and display certification authority (CA) configuration information, configure Certificate Services, backup and restore CA components, and verify certificates, key pairs, and certificate chains.
C. ADCS needs to be backup up using certutil
D. ADCS needs to be backup up using certutil
Disaster Recovery Procedures:
There are two methods to backup and restore the Certification Authority. The methods are:
1. System State Backup
2. Certutil command line in combination of registry export
Update: It just came to my attention that System State Backup in Windows 2008 and 2008 R2 will not backup the private key of the CA. The private key will be stored in hidden folder structure.
"%systemdrive\ProgramData\Microsoft\Crypto\Keys" which will be linked and accessible via "%systemdrive
%\users\all users\microsoft\crypto\keys".
%systemdrive%\ProgramData\Microsoft\Crypto\Keys" is not included in System State backup as it's not in system writers metadata and so will be empty when doing a System State restore.
If you prefer to have System State Backup, then you should consider applying the following hotfix: http:// support.microsoft.com/kb/2603469 on your CAs running Windows Server 2008 or 2008 R2 to backup the Private Key.
References:
https://technet.microsoft.com/library/cc732443.aspx
https://technet.microsoft.com/en-us/library/cc732443.aspx#BKMK_backup
https://technet.microsoft.com/en-us/library/cc732443.aspx#BKMK_backupDB
https://technet.microsoft.com/en-us/library/cc732443.aspx#BKMK_backupKey
http://blogs.technet.com/b/pki/archive/2010/04/20/disaster-recovery-procedures-for-theactive- directorycertificate-services-adcs.aspx