In tracking down another issue, I noticed that our domain controllers were autoenrolling 3 certs/day. There getting the new kerberos Auth template. certificates are issued for 1 year, with a 6 ...