Couple months ago I was making AD CS migration from W2003 to W2008 R2. When migration was done I was not able to install Web Enrollment service. Error message from Windows:
“Cannot install Certification Authority Web Enrollment
Active Directory Certificate Services setup failed with the following error: The parameter is incorrect. 0×80070057 (WIN32: 87)”
Modify SetupStatus at HKLM\System\CurrentControlSet\Services\CertSvc\Configuration to 0×6001 and you are able to install Web Enrollment service. After installation SetupStatus is changed to 0x6003.