In my organization we have two-tiers pki infrastrukture based on win server 2008. We have one offline root ca and online subordinate enterprise ca who is only memeber server of the AD DS 2008. We publish certificates in AD DS and issue certificate to the clients. They were logged on domain using smart card with no problems about 6 months. In a meantime we add one more subordinate enterprise issuing CA as a memeber server and after that we revoked our first subordinate CA server(it happened 2 months ago). 10 days ago our certificate on a domain controlers shoud be revoked and they did it but on a new subordinate issuing CA, because the first was revoked before that. After that day our clients(xp and vista) could not log on on domain and we have message that our credentials coul not be verified. When we try to do smart card logon on our member servers(2003 and 2008) we can do it. I could not solve the problem