Cert errors are harmless - they just mean there's no CA on your network.

With Windows 2000 domain controllers there isn't more than one method of logging in - it's all done via Kerberos. No Kerberos ticket, no login. NT workstations have this process shielded from them, but it boils down to the same thing. Certificates are not used in the Windows 2000 authentication process.

The only real practical differences between native and compatibility mode for the domain is that in native mode you get universal groups and can nest global groups.