Hello

We have moved our certification authority from "Windows Server 2008" to "Windows Server 2008 R2" according this blog entry:
http://www.scottfeltmann.com/index.php/2010/03/02/move-root-ca-from-w2k3-to-w2k8/

It works perfectly.  After that we wanted to install "Certificate Authority Web Enrollment" in Server Manager, but the following error appears:

"Cannot install Certification Authority Web Enrollment, Active Directory Certificate Services setup failed with the following error: The parameter is incorrect. 0x80070057 (WIN32: 87)"

Thanks for any help!

Regards
netbit

 

Any clues in the Event Log? Btw. the blog you referenced describes moving CA from one domain controller to another - this is actually not recommended (typically you would want to host a CA on a member server)

hth
Marcin

Hello Marcin

Thanks for your answer. The CA is now on a single server without any roles installed.
There are no events in the eventvwr for this error or anything else.

Just for clarification: If i try to select "Certificate Authority Web Enrollment" in the servermanager the error appears:

Screenshot: http://giezi.com/public/servermanager-error.PNG

Thanks!

Regards
Reto

Hello,

please check the following thread:

http://social.technet.microsoft.com/Forums/en-GB/winservergen/thread/0661f407-61d5-42c5-a90d-4d382e79993a

I facing the exactly same problem as the original poster in this thread.

I applied the hotfix, but the problem still occurs. I have moved the CA according to the MS migration guide and it worked fine until I tried to install the Web enrollment. Do I have to reinstall the entire CA again after the hotfix? or are there other workarounds?

Best Regards

Reto König

• Proposed as answer by Sami Lamppu Monday, May 02, 2011 6:25 AM
• Unproposed as answer by Sami Lamppu Monday, May 02, 2011 6:26 AM

Hi,

Does anyone know workaround for this? I have exact same situation at customer environment. I have test and production environments where I have been working on this.

Production:

Old CA environment has been migrated from W2003 -> W2008R2 and CA's were installed without web enrollment service. This was because AD schema was on version 31 and Microsoft states that web enrollment service is not working until schema has been upgraded to level 47.

Now I have upgraded AD schema (in test environment) to version 47 but I have same error than guys above. "Cannot install Certification Authority Web enrollment. Active Directory Certificate Services setup failed with the following error: The parameter is incorrect. 0x80070057 (WIN32: 87)".  

Best Regrads,

Sami Lamppu

Hi,

Does anyone know workaround for this? I have exact same situation at customer environment. I have test and production environments where I have been working on this.

Production:

Old CA environment has been migrated from W2003 -> W2008R2 and CA's were installed without web enrollment service. This was because AD schema was on version 31 and Microsoft states that web enrollment service is not working until schema has been upgraded to level 47.

Now I have upgraded AD schema (in test environment) to version 47 but I have same error than guys above. "Cannot install Certification Authority Web enrollment. Active Directory Certificate Services setup failed with the following error: The parameter is incorrect. 0x80070057 (WIN32: 87)".  

Best Regrads,

Sami Lamppu

Hello,

first as you can see this thread is really old and marked as answered. So better create your own one and describe all required details including error messages.

Also i suggest to use the Security forum instead this one:

http://social.technet.microsoft.com/Forums/en/winserversecurity/threads

Hi,

I notices that topic is very old but I found resolution for this problem.

 

Resolution:
Modify SetupStatus at HKLM\System\CurrentControlSet\Services\CertSvc\Configuration to 0×6001.

Then you can install Web enrollment without errors.

 

Best Regards,

Sami Lamppu

• Proposed as answer by RonMen 46 minutes ago

The registry change did the trick for me.

Thank You Sami

Worked for me, also found the same solution at MS blog

http://social.technet.microsoft.com/wiki/contents/articles/12035.ad-certification-authority-web-enrollment-configuration-failed-0x80070057-win32-87.aspx