Stéphane,

     Usually, not removing the AD object and revoking the certificate is not an operational problem.

     Before I joined Intel, I worked 8 years at Microsoft, mainly with AD deployments and is very common creation of some kind of procedure to periodically clean up old computer and users account not used for a period of time, and you can use since vb scripts until utilities like this.

     Certificate revocation is another subject: If the private key is destroyed when you make a full unprovision there is no real reason to revoke it, because revoking will not free space, it will increase the size of the CRL.

     I know that each one has his own administrative policies, but if you want, a script for unprovision can be tailored to orchestrate these activities.

My two cents!

-Bruno Domingues