We run DC, CA and DNS on W2012 (VMware virtual server). It worked well but some time ago I've noticed Event ID 91 after restart. I've checked permissions following http://technet.microsoft.com/en-us/library/cc774525(v=ws.10).aspx and there are 2 folders missing in the public key services node: "NTAuthCertificates object" and "Domain Computers and Domain Users containers". All other rights are set well. But it's a W2008R2 help and I can't find any relevant for W2012.
Running "nltest /sc_verify:[domainname]" command on CA/DC/DNS server I got "I_NetLogonControl failed: Status = 1355 0x54b ERROR_NO_SUCH_DOMAIN" error message. But the same command works well on other W2012 server in the domain.