This post assumes that only one server was hosting the AD CS role and no certificates issued by this server are currently in use. If you have certificates in use, then please see the links at the bottom of the page.
The following items appear in Event Viewer with the same (or very close) timestamp, and events #10028 & #13 reference a server that no longer exists (highlighted in green in the 2nd and 4th screenshots that follow):
This can happen when a Domain Controller or other Windows server hosting the Active Directory Certificate Services (AD CS) role is removed from the domain improperly. Sometimes this is unavoidable, for example if a server crashes. The solution is to remove the nonexistent server via Active Directory Sites and Services.
Step #1: Open Active Directory Sites and Services and show the “Services Node”
Step #2: Delete the offending (non-existent) server from the AIA, Enrollment Services, Certification Authorities, and KRA nodes
Note: it is absolutely critical that you do not delete any entries for servers that currently exist on the network!
Step #3: If no other AD CS servers exist on the network, then remove all Certificate Templates. If other AD CS servers exist, then skip this step.
Note: Seriously — do NOT do this part if any other AD CS servers exist on the network. You have been warned. If there are any other AD CS servers, they’ll show up when you remove the non-existent server in step #2.
Step #4: Cleanup
Run the following commands from an elevated command prompt:
certutil -dcinfo deleteBad gpupdate /force