When binding Macs to our domain we will import a computer cert so that the users Mac will be able to connect to our VPN and enterprise connect (can't do so without this cert). I have a user who is having this cert get auto removed from keychain and thus making him unable to connect to internal resources when working remotely. The cert that we import comes from our CA and is verified upon being imported.
My question is, is there a way I can look and see how/why this cert was removed?