The CA is supposed to publish the CRL to AD, but currently does not. Need to find out how to do this, and either document it, or figure out how to automate it.
Apparently this is not necessary. Windows will fetch the CRL from whereever the CRL DP says it is published to.
Bug already CLOSED/VERIFIED. setting screened+ flag