When you renew the Sub CA certificate which is domain joined, does the certificate:
1. Get published automatically to directory services without need of certutil -dspublish
2. propagation on all domain joined computers, automatically ? How is this done, is there a particular gpo ? as far as i know we did not set up any gpo to publish the current one.
Glenn Camilleri