Enterprise CA placement

Hello
We currently have a single 2003 active directory forest with one root empty
domain and 2 child domains.
We are going to create an offline standalone root CA (on a workgroup server)
then one issuing Enterprise CA (on a DC).

My question is,
1. which domain should we install the Enterprise CA on?
The issuing CA would be servicing all 3 domains. Can we install on one of
the child domain DCs or does it need to be on the root domain DC?

2. if we install 2 issuing CAs by installing CA on 2 different DCs, does it
provide redundancy in case one fails?

 

Please post this over to the windows.server.security newsgroup where it belongs

On the web:




--
Peter

Please Reply to Newsgroup for the benefit of others
Requests for assistance by email can not and will not be acknowledged.

"study" <study@discussions.microsoft.com> wrote in message
news:42613931-79CE-43A0-95F7-5FC0F675DDB2@microsoft.com...<!--coloro:blue--><span style="color:blue <!--/coloro-->
> Hello
> We currently have a single 2003 active directory forest with one root empty
> domain and 2 child domains.
> We are going to create an offline standalone root CA (on a workgroup server)
> then one issuing Enterprise CA (on a DC).
>
> My question is,
> 1. which domain should we install the Enterprise CA on?
> The issuing CA would be servicing all 3 domains. Can we install on one of
> the child domain DCs or does it need to be on the root domain DC?
>
> 2. if we install 2 issuing CAs by installing CA on 2 different DCs, does it
> provide redundancy in case one fails?
> <!--colorc--><!--/colorc-->