This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(278.4, 34%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPS%3C/text%3E%3C/svg%3E)
Error:
Active Directory Certificate Services setup failed with the following error: The security ID structure is invalid. 0x80070539 (WIN32: 1337 ERROR_INVALID_SID)
Environment: 1 Parent root domain (ABC.LOCAL) and 1 CHILD Domain (CHILD.ABC.LOCAL). We are trying to install Enterprise root CA server in CHILD Domain. The account used to install role is member of Enterprise Admin role and Domain Admin in Child Domain.
Is anyone experienced this issue before? Any advise would be appreciated.
Thanks!
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 80%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETB%3C/text%3E%3C/svg%3E)
Hi,
Did you have the same issue when you try install enterprise root certificate using a account in root domain members of enterprise admin?
Please don't forget to mark this reply as answer if it help you to fix your issue
Thanks for your comment. We did try that as well and experienced the same issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(96, 62%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDZ%3C/text%3E%3C/svg%3E)
Hello @Priyavert Sharma ,
Thank you for posting in our Q&A forum.
Would you please show us when you receive the error message above (it is better you can provide the screenshot)?
Meanwhile, on the machine that you want to install Enterprise root CA server in CHILD Domain, we can try the possible solution in the similar case below.
The security ID structure is invalid
https://stackoverflow.com/questions/18758375/the-security-id-structure-is-invalid
I am looking forward to your feedback.
Thank you for your time and efforts.
Best Regards,
Daisy Zhou
We have all the resources in Child Domain. Root Domain is only to manage Child Domain. No server/users are in Root Domain. I tried creating new account and made it member of Domain Admin in Child and Enterprise admin only with no luck.
could you please confirm if this tweak has to be applied at CA server? Thanks!
Hello @Priyavert Sharma ,
Thank you for your update.
1.Do you add AD CS role on member server or DC in child domain?
2.We can try to check SID about this user in Domain Adminis of child domian.
3.Check if AD replication si working fine by running repadmin /showrepl * /csv >C:\showrepl.csv and open showrepl.csv to check AD replication status.
Best Regards,
Daisy Zhou
Thanks Daisy for sharing the link. This did not help in fixing the issue. We are opening a ticket with Microsoft and will share the solution here once resolved.
Hello @Priyavert Sharma ,
Thank you for your reply.
And I hope the issue will be resolved soon.
Thank you for your upddate and sharing in advance.
Have a nice day!
Best Regards,
Daisy Zhou
Case is still Open with MS. We tried installing new server as well with no luck. They are analyzing the logs. I will update you once the issue is resolved.
Issue resolved.
We found that there was an account (abc.local) created in the child domain with root domain name. Fixing the UPN and logon name of that culprit account in child domain fixed the issue.
Hello @Priyavert Sharma ,
Thank you for your update. I’m very glad that the problem has been solved.
Meanwhile, thank you so much for your sharing.
As always, if there is any question in future, we warmly welcome you to post in this forum again. We are happy to assist you!
Have a nice day!
Best Regards,
Daisy Zhou