Event ID 17 — AD CS Database Availability

  • Article

Applies To: Windows Server 2008 R2

The certfication authority (CA) database records all certificate transactions, including requests, the requester, and whether the request was granted or denied; information for the issued certificate, such as the private key, serial number, and expiration date; and information about revoked certificates. Problems accessing a CA database can prevent a CA from starting and functioning properly. 

Event Details

Product: Windows Operating System
ID: 17
Source: Microsoft-Windows-CertificationAuthority
Version: 6.1
Symbolic Name: MSG_E_DB_INIT_FAILED
Message: Active Directory Certificate Services did not start: Unable to initialize the database connection for %1. %2.

Resolve

Enable the connection between the CA and the certificates database

A certification authority (CA) needs to be able to connect to a certificates database file identified in the registry. To resolve this problem, confirm that the file identied in the registry exists, and if it does exist, that it has not been corrupted. 

To perform this procedure, you must have local administrator permission, or you must have been delegated the appropriate authority.

To enable the connection between the certification authority (CA) and the certificates database:

Caution: Incorrectly editing the registry might severely damage your system. Before making changes to the registry, you should back up any valued data.

  1. On the computer hosting the CA, click Start, type regedit, and then press ENTER.

  2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration.

  3. Check the value data for the REG_SZ entries named DBLogDirectory, DBSystemDirectory, and DBTempDirectory. Then, confirm that the CA database files exist in these locations.

  4. At a command prompt, type **Esentutl.exe /g <databasename> **and press ENTER to check for database corruption.

    Replace databasename with the name of the database listed in the registry settings.

  5. If the database has been corrupted, at a command prompt, type Esentutl /r <databasename> and press ENTER to correct the problem.

  6. Restart Active Directory Certificate Services (AD CS).

Verify

The certificate database must be available in order for the Active Directory Certificate Services (AD CS) service to start.

To perform this procedure, you must have membership in local Administrators on the computer hosting the certification authority (CA), or you must have been delegated the appropriate authority.

To confirm that the CA database connection has been enabled:

  1. On the computer hosting the CA, click Start, point to Administrative Tools, and click Services.
  2. If Started is displayed in the Status column for the Active Directory Certificate Services service, the CA database connection has been enabled.

AD CS Database Availability

Active Directory Certificate Services