In my AD environment, I deployed a template that provides RDP certificates for servers. It's set on autoenroll.
The problem is, most of the servers work as I would expect: the got the certificate and it's enough for them. However, few servers get a new certificate every 12 hours. I read the article https://social.technet.microsoft.com/wiki/contents/articles/38085.certificate-autoenrollment.aspx and I understand what is happening, but I don't get WHY this is happening - what triggers the server to request a new cert even though one already exists?
I don't want to publish the certs in AD, especially since only a few servers are showing this anomaly - others are fine. All the certificates generated this way are still valid, and the private key exists.
OK, now I found the answer: https://support.microsoft.com/en-us/help/2531138/remote-desktop-server-certificates-are-renewed-two-times-a-day-despite. It's a bug in Windows 2008/R2.