How To
Summary
This knowledgebase article outlines the approved processes for managing and cleaning up failed certificate requests on a Microsoft Active Directory Certificate Services (AD CS) Certification Authority. It explains how administrators can safely identify, assess, and remove failed requests using Microsoft‑supported tools, as well as an optional PowerShell‑based approach (PSPKI) for advanced automation scenarios. The article also details required permissions, prerequisites, and operational safeguards to ensure cleanup activities do not impact issued certificates or trust relationships. Failed certificate requests are non‑trusted, non‑issued artifacts and may be safely deleted as part of routine CA maintenance.
Objective
This article provides step‑by‑step guidance to identify, review, and remove failed certificate requests from a Microsoft Active Directory Certificate Services (AD CS) Certification Authority (CA).
It includes:
- Microsoft‑supported cleanup methods
- Optional advanced automation using the PSPKI PowerShell module
- Required permissions and prerequisites
- Safety and operational best practices
Important: Failed certificate requests are not issued certificates. They contain no private keys, are never trusted, and may be safely deleted when no longer required.
Environment
Enterprise and Standalone AD CS
- Windows Server 2016 / 2019 / 2022
- On‑premises Certification Authorities
Steps
Definitions
| Term | Description |
|---|---|
| Failed Request | Certificate request that did not complete issuance |
| Issued Certificate | Successfully generated and trusted certificate |
| CA Database | ESE database used by AD CS to store requests and metadata |
Prerequisites
System Requirements
- Active Directory Certificate Services installed
- Interactive or remote administrative access to the CA server
Required Permissions
You must have Manage CA permissions, typically via:
- Enterprise Admin
- Domain Admin
- CA Administrator
To validate permissions:
- Open Certification Authority
- Right‑click the CA → Properties
- Select Security tab
- Confirm Manage CA is allowed
Step 1: Open the Certificate Authority Console
- Log on to the CA server
- Open Run
- Enter:
certsrv.msc
- Press Enter
- Expand the CA name
Step 2: Review Failed Certificate Requests
- Select Failed Requests in the left pane
- Review the following fields:
- Request ID
- Requester Name
- Submitted When
- Failure Reason
These requests were never issued and are eligible for cleanup.
Step 3: Remove Failed Requests (GUI Method)
Recommended for small volumes
- Highlight one or more failed requests
- Right‑click → Delete
- Confirm deletion
Note: No service restart required
Step 4: Bulk Cleanup Options
Two supported cleanup approaches are available depending on operational requirements.
Option A – Microsoft‑Supported Method (Recommended)
Using certutil
This is the primary and fully supported cleanup mechanism.
4A‑1. Stop Certificate Services
net stop certsvc
4A‑2. Delete Failed Requests Before a Specific Date
certutil -deleterow Request Failed 01/01/2025
To remove all failed requests:
certutil -deleterow Request Failed
4A‑3. Restart Certificate Services
net start certsvc
Option B – PowerShell Automation Using PSPKI (Optional / Advanced)
Notice: PSPKI is a community module. It is not included with Windows and is not supported by Microsoft. Use only if third‑party modules are approved in your environment.
When to Use PSPKI
- Large CA environments
- Detailed reporting and auditing
- Automation without stopping certsvc
Additional Prerequisites
- PowerShell 5.1 or later
- Access to PowerShell Gallery
- Organizational approval for third‑party modules
4B‑1. Install PSPKI
Install-Module PSPKI -Repository PSGallery
Verify installation:
Get-Module -ListAvailable PSPKI
4B‑2. Review Failed Requests
Get-CARequest -Failed |
Select RequestID, RequesterName, CommonName, SubmittedWhen, DispositionMessage
4B‑3. Export Failed Requests (Audit)
Get-CARequest -Failed |
Export-Csv C:\CA_FailedRequests_Report.csv -NoTypeInformation
4B‑4. Delete Failed Requests Older Than 30 Days
Get-CARequest -Failed |
Where-Object { $_.SubmittedWhen -lt (Get-Date).AddDays(-30) } |
Remove-CARequest -Force
Recommendation: Use certutil during maintenance windows. Use PSPKI only for approved automation scenarios.
Step 5: Optional CA Database Maintenance
Backup CA Database
certutil -backup DB C:\CABackup
Offline Database Compaction (Advanced)
esentutl /d %SystemRoot%\System32\CertLog\<CAName>.edb
Note: Requires full service downtime
Step 6: Verification
- Reopen Certification Authority
- Confirm Failed Requests is reduced or empty
- Review Event Viewer:
- Microsoft → Windows → CertificateServicesCA
Step 7: Preventing Future Failed Requests
Common Causes
- Template permission issues
- Invalid SAN values
- Auto‑enrollment misconfiguration
- Network/RPC connectivity failures
Recommendations
- Validate template security permissions
- Review SAN enforcement
- Monitor Event IDs 53, 57, and 100
- Investigate spikes in failed requests
Step 8: Regular Maintenance Best Practices
- Monthly or quarterly review
- Audit before deletion
- Track CA database growth
Example scheduled cleanup (certutil):
certutil -deleterow Request Failed 01/01/2025
Unsupported Actions
- Direct CA database editing
- Deleting issued or revoked certificates without review
- Unapproved third‑party tooling
Summary
- Failed certificate requests can be safely removed
- certutil is the authoritative, supported method
- PSPKI enables advanced automation and reporting
- Regular maintenance prevents CA database growth
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
24 April 2026
UID
ibm17270777