Found this from Labmice:
CAUSE
This behavior can occur if the Autoenrollment feature cannot reach an Active Directory domain controller. In a Microsoft Windows NT 4.0 domain, Active Directory is not available, so Autoenrollment cannot work. In an Active Directory domain with Microsoft Windows 2000 or later domain controllers, the problem can be caused by a DNS name resolution or network connectivity issue.
RESOLUTION
For a Windows XP-based or a Windows Server 2003-based computer that is joined to a Windows NT 4.0 domain, to disable Autoenrollment in the Local Group Policy, follow these steps on the local workstation:
Click Start, click Run, type gpedit.msc, and then press ENTER.
In the left pane, expand Computer Configuration, expand Windows Settings, expand Security Settings, and then expand Public Key Policies
Double-click Autoenrollment Settings.
Click Do not enroll certificates automatically.
Click OK.
Repeat steps 2 through 5, but in step 2, expand User Configuration, expand Windows Settings, expand Security Settings, and then expand Public Key Policies.
Close the Group Policy window.
For a computer that is a member of a Windows 2000 or later Active Directory domain, make sure that the domain member has network connectivity with at least one domain controller.
After you have determined that you have good Internet Protocol (IP) connectivity between the member and a domain controller, correct the DNS address in the IP properties of the workstation:
Start the Network Connections tool in Control Panel.
Right-click Local Area Connection, and then click Properties.
Click Internet Protocol (TCP/IP), and then click Properties.
Type the correct DNS address in the Preferred DNS server box.
Click OK.
