Before you install the Certificate Enrollment Web Service or Certificate Enrollment Policy Web Service, the Active Directory ...

Before you install the Certificate Enrollment Web Service or Certificate Enrollment Policy Web Service, the Active Directory schema must be updated. A schema update cannot be reversed and is replicated throughout the forest. To update the schema, use at least the Windows Server 2008 R2 version of adprep.exe, and run Adprep /forestprep.