Request Smartcard Logon certificates for more than 2 years from Certificate Authority

Question

Dear all,
I have setup a Certificate Services in a Windows Server 2008 R2 domain and I request certificates via the CA webpage
http://ipofdomainserver/certsrv using the SmartCard logon custom template.
The problem is that my certificates are only valid for 2 years even though when I created my custom Smartcard logon I selected for validity period 5 years. 
I read in documentation that issued certificates cannot have a greater validity than the root that signed them.
What and where I should modify to be able to request certificates from the template for more years than standard 2 ?
Ps: WINSC-CA is valid for 5 years. Should I generate a new WINSC-CA ? How ?

Answer 1

I was successfully able to create a root CA for 20 years, issued a certificate and login using smartcard using the following procedure:
1. I increased the CA lifetime to 20 years by using this link http://www.expta.com/2010/08/how-to-create-certificates-with-longer.html
Created the file CAPolicy.inf in %SYSTEMROOT% with following content
[Version]
Signature=”$Windows NT$”
[certsrv_server]
RenewalValidityPeriod=Years
RenewalValidityPeriodUnits=20
2. Renew CA root using this guide  https://technet.microsoft.com/en-us/library/cc780374(v=ws.10).aspx
Console Root -> Certification Authority -> select domain -> Right click -> All Tasks ->
Renew CA certificate
3. Delete from Console Root -> Certificates (local computer) -> Trusted Root Certification
Authority -> Certificates the *WINSC-CA that has the previous lower validity, and from 
Certificates (local computer) -> Personal, the *WINSC-CA that was lower validity
4. I performed a reboot here
5. Change in Console Root -> Certificate Templates -> Smartcard Logon Custom Template (my custom duplicate template) -> Properties -> Validity 10 years
6. Change in registry HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\CertSvc\Configuration\<CAName>\ValidityPeriod
to value 10 for 10 years.
7. Request a new certificate from CA webpage http://ipofdomain/certsrv and let the webpage write it to
smartcard (I was making sure there is no other certificate on the smartcard)
8. Try to log in. At this point it should throw an erorr that smartcard logon is not supported for this
account type. This is becuase we need to enroll it again for domain authentication
9. Console Root -> Certificates (local Computer) -> Personal -> Right click -> All Tasks ->
Request new Certificate -> Next -> Active Directory Enrollment -> Next -> Select Domain Controller Authentication -> Enroll -> Finish.
Now you should be able to login using your smartcard and 10 years generated certificate.
Though I have a problem at step 3, after CA server reboots the *WINSC-CA certificate with lower
validity is restored automatically, but the certificates are generated for 10 years.
What am I doing wrong ? How can I delete the lower validity root CA ?