我已将我的 Active Directory 证书服务企业 CA 迁移到新服务器（并从 Windows 2003 R2 x86 迁移到 Windows 2008 R2 x64）。我在检查证书吊销列表时遇到了问题，但我已经从根 CA 重新发布了吊销列表，当我运行 certutil -urlfetch -verify 时，我不再收到任何错误：
Verified Issuance Policies: None
Verified Application Policies: All
Cert is a CA certificate
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.
但是当我尝试启动 CA 时，我仍然遇到同样的错误。我收到以下弹出窗口：
Microsoft Active Directory Certificate Services
---------------------------
The system cannot find the file specified. 0x2 (WIN32: 2)
The policy module for a CA is missing or incorrectly registered. To view or change
policy module settings, right-click on the CA, click Properties, and then click the
Policy Module tab.
---------------------------
OK
我在日志中收到以下错误：
Log Name: Application
Source: Microsoft-Windows-CertificationAuthority
Date: 26/06/2012 15:59:45
Event ID: 100
Task Category: None
Level: Error
Keywords: Classic
User: SYSTEM
Computer: SRV112.cobbsch.cobbetts.co.uk
Description:
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate. Cobbetts LLP Enterprise CA The system cannot find the file specified. 0x80070002 (WIN32: 2).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-CertificationAuthority" Guid="{6A71D062-9AFE-4F35-AD08-52134F85DFB9}" EventSourceName="CertSvc" />
<EventID Qualifiers="49754">100</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2012-06-26T14:59:45.000000000Z" />
<EventRecordID>852</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>Application</Channel>
<Computer>SRV112.cobbsch.cobbetts.co.uk</Computer>
<Security UserID="S-1-5-18" />
</System>
<EventData Name="MSG_E_CA_CERT_INVALID">
<Data Name="CACommonName">Cobbetts LLP Enterprise CA</Data>
<Data Name="ErrorCode">The system cannot find the file specified. 0x80070002 (WIN32: 2)</Data>
</EventData>
</Event>
Microsoft 有此错误的文档：http ://technet.microsoft.com/en-us/library/cc774550(v=ws.10).aspx
但是文档只讨论了 CA 链没有验证，现在是这样。
我想知道这是否是某种缓存故障，或者是不正确 CRL 的缓存副本（我之前迁移了根 CA，并且必须在 certutil 正确验证之前重新发布 CRL），所以我尝试重新启动以清除缓存。
那并没有改变任何事情。
我还尝试以 SYSTEM 身份运行 Certutil 以查看是否存在权限问题，但这也没有解决问题。
[作为系统运行：从提升的命令提示符运行 psexec -i -s cmd.exe，它将作为系统启动命令提示符。你可以运行 whoami 来检查。]
