The certificate issuance policy descriptor %1 cannot be linked to group %2. Issuance policies can be linked through the attribute ...

The certificate issuance policy descriptor %1 cannot be linked to group %2. Issuance policies can be linked through the attribute msDS-OIDToGroupLink only to universal, security-enabled groups that have an empty membership. You should ensure that this group meets these requirements.
The error is %5.