KDC certificate error

Question

Hello, 
Im having issues and errors in the event viewer with the KDC certificates.
We have 2 windows 2003 domain controllers (one was Certificate Authority) and we are migrating to Windows 2012, the steps that we have done are:
- Forest and domain at Windows 2003 level.
- Create 2 new domain controllers in Windows 2012 (only DNS and GC, no fsmo roles yet), adding it as new ones in the domain (so 4 domain controllers).
- Revoke all the certificates from the CA (it was only for tests propousal) and deinstall it completely.
- In the Windows 2003 domain controllers started the error:
Event Type: Warning
Event Source: KDC
Event Category: None
Event ID: 20
Date: 12/17/2006
Time: 1:49:47 AM
User: N/A
Computer: SERVER
Description:
The currently selected KDC certificate was once valid, but now is invalid and no suitable replacement was found. Smartcard logon may not function correctly if this problem is not remedied. Have the system administrator check on the state of the domain's public
key infrastructure. The chain status is in the error data.
- In the Windows 2012 domain controllers started the errors:
Event 82: CertificateServicesClient-CertEnroll: RPC server unavailable, error in template: DomainController
Event 13: CertificateServicesClient-CertEnroll: Error RPC: Server.domain.local/CAdomain (where Server is the domain controller were the CA was, and CAdomain the name of the old CA just deleted)
Event 6: CertificateServicesClient-AutoEnrollment: Error RPC
With certutil -dcinfo verify there was errors, so we applied certutil -dcinfo deleteBad. After that the errors are (for the 4 domain controllers): 
*** Testing DC[0]: SERVER
** Enterprise Root Certificates for DC SERVER
No certs in Ent Root store!
** KDC Certificates for DC SERVER
0 KDC certs for SERVER
No KDC Certificate in MY store
KDC certificates: Cannot find object or property. 0x80092004 (-2146885628)
We have deleted templates as this article (as we havent got CA now):
http://www.petenetlive.com/KB/Article/0000473.htm
But the errors still here. We have gpupdate /force and restart the domain controllers but nothing...
We have tried to request a new certificate with this steps:
Create a computer certificate using mmc snap-in 'certificates' by right clicking on 'Certificates' folder Under 'root\Personal' tree, and clicking All Tasks -> Request New Certificate. Certificate Enrollment window appears, you verify you are connected to
your network and you are logged onto the domain.
Then Click Next, which leads to a window stating the issue:
"Certificate types are not available"
"You cannot request a certificate this time because no certificate types are available. If you need a certificate contact your administrator."
Any help will be appreciate.
thanks

Answer 1

It appears that Active Directory wasn't cleaned correctly. You need to completely decommission CA server from Active Directory:
http://social.technet.microsoft.com/wiki/contents/articles/3527.how-to-decommission-a-windows-enterprise-certification-authority-and-how-to-remove-all-related-objects.aspx
Start with step 6.
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.