Have you recently deployed Credential Roaming with Vista clients and your NTDS.dit file on your DCs keep growing? It is a known issue.

You'll want to investigate KB 934797 and request the hotfix for your Vista clients to prevent excessive certificate refreshes.

Not sure what Credential Roaming is? Read about it here.

Unrelated to this hotfix, but worth noting, is that there is a hotfix available for Windows 2003 and Windows XP so that they do not strip the newer CNG data that can come from Windows Vista and Windows Server 2008 operating systems.