We did this some time ago. I wrote a script that does it remotely. It requires the ping() and fADSIServiceRun() UDF's. You should change the name of the old and the new certificate to the names they have in your setup. We did not copy the grc.dat file I can’t remember anymore why we skipped that part.
Computers.txt holds all computer names that have trouble communicating with the management server. It reads the file line by line, pings the computer and if the ping is successful it updates the certificate and restarts two services if the ping is not successful it writes the name to the computers_error.txt file.


 Code:
Break on

Call @SCRIPTDIR + "\ping().udf"
Call @SCRIPTDIR + "\fADSIServiceRun().udf"

$path = "\C$\Program Files\Symantec AntiVirus\pki\roots\"
$service1 = "Symantec Event Manager"
$service2 = "Symantec Settings Manager"

$rc = Open (1, @SCRIPTDIR + "\computers.txt", 2)
$rc = Open (2, @SCRIPTDIR + "\computers_error.txt", 5)

$computer = ReadLine (1)
While @ERROR = 0
	$online = Ping($computer,0,1,1000)
	If $online <> "0"
	?"Online."
		Del "\\" + $computer + $path + "36a2999be3558f4bb9ea6e7df080fae6.0.servergroupca.cer"
		Copy @SCRIPTDIR + "\new\e69e7a505a9e5540bdbda2b1db9498e1.0.servergroupca.cer" "\\" + $computer + $path
		fADSIServiceRun($computer, $service1, 0)
		fADSIServiceRun($computer, $service2, 0)
		fADSIServiceRun($computer, $service1, 1)
		fADSIServiceRun($computer, $service2, 1)
	Else
		?$computer + " is not online."
		$rc = WriteLine (2, $computer + @CRLF)
	EndIf
	$computer = ReadLine (1)
Loop

$rc = Close(1)
$rc = Close(2)


Client-server communication problems occur after repair or reinstallation of server
Ping() - checks for reply , or returns ip-address of remote host
fADSIServiceRun() - ADSI routine that starts, stops ,pause, and continues a service
_________________________
Mart

- Chuck Norris once sold ebay to ebay on ebay.