active directory: decommission a certificate authority
i have done this once with no apparent consequences…
http://support.microsoft.com/kb/889250
update 4/21/2014:
the utility pkiview.msc that comes with the windows server 2003 resource kit can be used to determine the health of a CA.