after migrating to a CA on Windows Server 2008 R2 the "Domain Controller Authentication" Certifikate can no longer used to run EAP Auth with IAS/NPS cause the "Subject" is missing !!! Found this here http://setspn.blogspot.com/2010/12/error-selecting-certificate-when.html?showComment=1313245992613#c778045168030747809 Modify the Template for "Domain Controller Authentication to fill the Subject with the DNS name. This saves my day ^^ @ MS a KB Artikle would be nice ^^

Check this similar post. I would have post in Windows Server NAP forum. Thanks