Couple months ago I was making AD CS migration from W2003 to W2008 R2. When migration was done I was not able to install Web Enrollment service. Error message from Windows:

“Cannot install Certification Authority Web Enrollment

Active Directory Certificate Services setup failed with the following error:  The parameter is incorrect. 0×80070057 (WIN32: 87)”

Resolution:

Modify SetupStatus at HKLM\System\CurrentControlSet\Services\CertSvc\Configuration to 0×6001 and you are able to install Web Enrollment service. After installation SetupStatus is changed to 0x6003.