Synchronize Issue caused by Expired ISA CSS Certificate

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

The two CSS cannot synchronize with each other, or the firewall server cannot synchronize with the CSS. Consequently, the changes made in ISA MMC cannot take effect. Under Monitoring-Configuration in ISA MMC, you may find the following message.

ISA Server cannot connect to specified configuration storage server.

Cannot retrieve data from �

This issue may occur when the ISA CSS Certificate Expired.

You can verify this by going to the certificate MMC ISASTGCTRL Personal store:

1. Run mmc.exe

2. Click File-> Add/Remove Snap-in. Click Add button. Select Certificates and click Add. Select "Service account" and click Next. Click Next.

3. Select ISASTGCTRL and click Finish. Browse to ADAM_ISASTGCTRL\Personal -> Certificates.

4. Open the listed certificate to see if it is expired.

Delete the expired certificate, request a new server authentication certificate and install it on CSS server.

For details, please check detailed steps in section "Installing a Certificate for Workgroup Authentication" of the article below:

http://technet.microsoft.com/en-us/library/cc302483.aspx