Problem with CRL distribution in AD Certification Authority

Question

I am implementing an AD Cert Auth for purposes of 802.1x secure WLAN. I am using a 2012R2 domain controller as the CA and a 2008R2 web server.
Following the steps in this document: http://technet.microsoft.com/en-us/library/cc730811.aspx and other docs linked therein.
Part-way through I had to change the web server being used for distribution of Certs and CRL's (for reasons I won't elaborate just now) and doing so seems to have screwed things up.
When I run pkiview.msc on the CA it shows the cert itself and the AIA Location as OK, but the CDP and DeltaCRL locations as in error. The url's are correct.
In the event log I find Cert Auth Event ID 65 with this text: "Active Directory Certificate Services could not publish a Base CRL for key 0 to the following location: file://\\pki.mydomain.com/pki/mydomain-Server01-CA.crl.  The system cannot
move the file to a different disk drive. 0x80070011 (WIN32: 17 ERROR_NOT_SAME_DEVICE)."
Running certutil -crl produces a similar error:
PS C:\Windows\system32> certutil -crl
CertUtil: -CRL command FAILED: 0x80070011 (WIN32: 17 ERROR_NOT_SAME_DEVICE)
CertUtil: The system cannot move the file to a different disk drive.
PS C:\Windows\system32>
I am not (to my knowledge) trying to move anything, but presumably under the covers something is being moved.
If I manually copy the CRL and +.crl files from the CA to the web server, the error goes away but only until the next reboot or redistribute cycle - which is daily.
Anyone know how I can recover from this?
No sig is a good sig

Answer 1

I never had this issue previously, however, I would check:
1) whether CA server has Change or better share permissions on remote share
2) whether CA server has write or better NTFS permissions on the remote folder
only if all is correct and all permissions are set correctly, I would try to remove file:// prefix. Just UNC path.
just to clarify: isn't this share located on the same server as CA?
Vadims Podāns, aka PowerShell CryptoGuy
My weblog: en-us.sysadmins.lv
PowerShell PKI Module: pspki.codeplex.com
PowerShell Cmdlet Help Editor pscmdlethelpeditor.codeplex.com
Check out new: SSL Certificate Verifier
Check out new:
PowerShell File Checksum Integrity Verifier tool.