Active Directory Certificate Services won't start - error 100

I've migrated my Active Directory Certificate services Enterprise CA to a new server (and from Windows 2003 R2 x86 to Windows 2008 R2 x64). I have been having problems with checking the Certificate Revocation Lists, but I've republished the revocation lists from the Root CA and when I run certutil -urlfetch -verify I don't get any errors any more:

Verified Issuance Policies: None
Verified Application Policies: All
Cert is a CA certificate
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.

But I still get the same errors when I try to start the CA. I get the following pop-up:

Microsoft Active Directory Certificate Services
---------------------------
The system cannot find the file specified. 0x2 (WIN32: 2)

The policy module for a CA is missing or incorrectly registered. To view or change
policy module settings, right-click on the CA, click Properties, and then click the
Policy Module tab.
---------------------------
OK   

and I get the following error in the log:

Log Name:      Application
Source:        Microsoft-Windows-CertificationAuthority
Date:          26/06/2012 15:59:45
Event ID:      100
Task Category: None
Level:         Error
Keywords:      Classic
User:          SYSTEM
Computer:      SRV112.cobbsch.cobbetts.co.uk
Description:
Active Directory Certificate Services did not start: Could not load or verify the current CA certificate.  Cobbetts LLP Enterprise CA The system cannot find the file specified. 0x80070002 (WIN32: 2).
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-CertificationAuthority" Guid="{6A71D062-9AFE-4F35-AD08-52134F85DFB9}" EventSourceName="CertSvc" />
    <EventID Qualifiers="49754">100</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>0</Opcode>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2012-06-26T14:59:45.000000000Z" />
    <EventRecordID>852</EventRecordID>
    <Correlation />
    <Execution ProcessID="0" ThreadID="0" />
    <Channel>Application</Channel>
    <Computer>SRV112.cobbsch.cobbetts.co.uk</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData Name="MSG_E_CA_CERT_INVALID">
    <Data Name="CACommonName">Cobbetts LLP Enterprise CA</Data>
    <Data Name="ErrorCode">The system cannot find the file specified. 0x80070002 (WIN32: 2)</Data>
  </EventData>
</Event>

Microsoft have documentation for this error: http://technet.microsoft.com/en-us/library/cc774550(v=ws.10).aspx

But the documentation just talks about the CA chain not verifying, which it now is.

I was wondering if it was some sort of a cached failure, or a cached copy of an incorrect CRL (I migrated the root CA earlier on and had to republish the CRL before certutil would verify properly), so I tried a reboot to flush out the caches.

That didn't change anything.

I've also tried running Certutil as SYSTEM to see if there was a permissions issue and that didn't solve the problem either.

[To run as system: run psexec -i -s cmd.exe from an elevated command prompt and it will launch a command prompt as system. You can run whoami to check.]

I resolved this issue with Microsoft support, but I didn't really understand what they did to resolve it.

Dug up the Microsoft support notes, in the hope these are useful to someone:

1. We found CRL in certenroll folder were missing to validate revocation status from root CA.
2. We copied CRL from Intermediate CA to Issuing Sub-CA but still got error.
3. As per debug team Engineer we removed and reinstall ADCS roles but it did not helped.
4. Finally we found under HKLM\system\CurrentControlSet\Services\Certsvc\Configuration registry CertHash had older values for expired certificates.
5. Removed the older values of hashes and replaced them with (–) signs and started Certificate service.
6. Certificate Service Started Successfully.