In this demonstration,
we're going to restore our certification authority from the backup.
We apply the checkpoint to have a fresh server without
the Certificate Services installed.
We install the Certificate Services on the fresh server.
We merge the configuration registry,
and we'll be restoring the CA from a snap‑in.
And then finally, set the CAPolicy.inf file.
We start off here with a CA1.
Notice, I don't have anything really installed on this server.
That's because I've reverted it or taken a checkpoint with Hyper‑V
back to just a fresh install of Windows Server 2022.
What we're doing here is simulating an environment where we have a fresh
server that we're transferring the root server to.
And we begin by changing the IP address.
We change the IP address to simulate a fresh server.
So I come up here to Ethernet settings, click on it.
We'll go to Network 2, Change adapter options.
Here it is right here.
You've probably done this quite a few times.
I'm going to go to Properties, double‑click on TCP/IPv4,
and we change this last octet from 11 to a 12.
Simple as that.
Go ahead and click on OK, and then OK again, and we'll go ahead and close this.
Now we need to map that network drive in order to get to the backup files.
So I'll come to a command prompt down here,
type in cmd,
and then come up here and map this network drive with
the same command that we had before.
Now we're pretty much all ready to go.
We're going to Add roles and features to install the CA.
I'll say Next, Next, Next, you've been through this.
CA1, it's right there, Active Directory Certificate Services.
This installation looks the same,
but there's a few different things that we're going to actually do.
I'm going to say Add Features and then click on Next,
Next, Next, Next again, and then finally Install.
And it's going to go through and install the service.
And when we actually configure the service,
it's going to be a little bit different.
We have a current certificate that we're going to use
instead of creating a new one from scratch like we did when
we originally installed the root CA.
So this just takes a second, and there it's done.
I'm going to close this, come up here, and we are ready to configure this.
I'm going to click on that.
We have the credentials, Certification Authority, click on Next, Standalone CA.
It's a root CA, and here we have the difference.
Use existing private key.
We take the first option here,
Select a certificate and use its associated private key.
Click on Next, and then we say import.
Go to Browse, This PC, and right down here, there it is.
This is our CarvedRockRootCA.
We click on it and then say Open, put in the password,
if you remember from the last it's a G, and then click on OK.
And then it goes through the import process,
which takes a little bit, but there's some verification going on here.
So we just say this one, the only one we have so we better say it,
and then click on Next.
This is important.
If you are restoring a root CA or really any CA, you see this?
It's on the default, the C drive.
If this was a D drive and it just happened to be because this
new installation required something different,
this is not going to work.
It has to be the same drive, the same path that it was before,
more accurately,
the same drive and path that it was on your previous backed‑up CA.
So we're all good here.
We're going to click on Next.
We took the defaults the last time, so the default is the C Drive,
Windows\system32\CertLog.
It takes just a moment to go through there and import
everything and looks like we did it.
We're going to say Configure right down here.
And just like that, we have a Certification Authority.
I'm going to click on Close there and then come up here to
tools and go to Certification Authority.
It's time that we import the REG files that we exported before.
So in order to do that, I have to come in here,
right‑click, go to All Tasks, and say Stop Service.
I'll come down to File Explorer, go to This PC.
You can probably guess where we're going to go with this.
We're going to go to the S drive, which is right here.
It's going to look for a REG file, and there it is right here.
So I just say right‑click, Merge.
It's going to pop up a warning here saying this is a registry,
you've got to be careful about this.
And it says, well, this is from outside of your network, better be careful.
And we'll take heed of that and just say OK,
I don't care, run, and click on Run.
Another warning message, we'll say we're okay, Yes, and then we click on OK.
We'll go ahead and close this and come back to our CarvedRootCA.
Then I can right‑click, All Tasks, and say Restore CA.
We have our Private key.
We have Certificate database and certificate database log.
I'm going to click on Browse, and then scroll way up,
close the C drive, and come down here, and click on OK,
click on Next, the password, and then click on Finish.
So we've imported the certificate.
We have restored this CA, and as soon as this is done here,
which it is now, I'll read it to you, The restore operation is complete.
Do you want to start Active Directory Certificate Services?
And we're going to say Yes.
Let's go ahead and do that.
It runs through and starts the Certificate Services,
and we've just taken the very top of our hierarchy,
switched servers, as it were back, to a new one.
Now remember, you're going to have to go into DNS if you keep this.
I'm going to just revert, but if you do keep it,
you're going to have to go through there and change the
DNS to the new IP address that you have.
Also keep in mind, if this was an enterprise CA,
you're going to have to tell it when you back it up what
certificates that you've made available,
but the process is basically the same. So that is how you restore a root CA in Windows Server 2022.