Category: Network Device Enrollment Service (NDES)

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In their documentation, they do write that NDES is not compatible with ML-DSA :

You can enroll ML-DSA certificates through the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) isn't currently available.

But that's not entirely true…

Continue reading "Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)"

The Simple Certificate Enrollment Protocol (SCEP) is an ancient protocol from the early 2000s. It does not use Transport Layer Security (TLS). Therefore, the protocol messages are encrypted at the transport layer.

When sending the certificate request to the NDES server, the client will encrypt the certificate request with the NDES server's CEP Encryption certificate (which was previously communicated to it via the GetCACert message).

When the issued certificate is received, the NDES server will encrypt the response with a self-signed certificate temporarily created by the SCEP client.

In both cases, a symmetric encryption algorithm is used.

Continue reading "Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)"

Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune . This can then be used to compromise the entire Active Directory environment.

The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It " and in the article "Attack vector on Active Directory directory service via smart card logon mechanism " (generally also known as ESC1 ).

What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.

What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...

Continue reading "Attack on the Active Directory via Microsoft Intune - and how it can be contained with TameMyCerts"

Assume the following scenario:

• A Network Device Enrollment Service (NDES) is to be implemented in the network.
• Only read-only domain controllers (RODC) are located at the Active Directory site of the NDES server.
• NDES role configuration fails with the following error message:

Failed to add the following certificate templates to the enterprise Active Directory Certificate Service or update security settings on those templates:
EnrollmentAgentOffline 
CEPEncryption
IPSEC(Offline request)
A referral was returned from the server. 0x8007202b (WIN32:8235 ERROR_DS_REFERRAL)

Continue reading "Unable to install Network Device Enrollment Service (NDES) at a site with only read-only domain controllers"

In a networked world, it has become standard to work from anywhere, and also to work with mobile end devices such as smartphones or tablets in addition to classic desktop computers. Such end devices are usually managed by Mobile Device Management (MDM) systems such as Microsoft Intune.

In most cases, users of mobile devices need digital certificates to prove their identity in order to gain access to corporate resources. Thus, it is necessary to provide these devices with an automatable yet secure interface for requesting these certificates.

Continue reading "Requesting certificates for endpoints managed with Microsoft Intune"

Assume the following scenario:

• A certificate is requested through the Network Device Enrollment Service (NDES).
• Renewal mode is used here, i.e. the certificate request is signed with an existing certificate.
• The request for the new certificate fails with the following error message:

A certification chain processed correctly, but one of the CA
certificates is not trusted by the policy provider. 0x800b0112 (-2146762478 CERT_E_UNTRUSTEDCA)

Continue reading "Renewal of a certificate via the Network Device Enrollment Service (NDES) fails with error code CERT_E_UNTRUSTEDCA"

As computing power becomes increasingly available, the need to use stronger cryptographic keys also increases. In this course, there is often a need (for example, because the keys have to be protected by a Trusted Platform Module) to use keys based on elliptic curves (ECC) . For their use, it is essential that compatibility with the intended use cases is ensured.

Below is a list of use cases for which I know the compatibility.

Continue reading "List of certificate use cases for which compatibility with elliptic curve (ECC)-based keys is known"

The Network Device Enrollment Service (NDES), because it implements the web-based Simple Certificate Enrollment Protocol (SCEP), is mapped as a web application in Microsoft Internet Information Service (IIS). Here, the service runs in an application pool called "SCEP". In many cases it is sufficient to use the integrated application pool identity for it .

However, there are cases where you want to use a domain account. An example of this is the Certificate Connector for Microsoft Intune, which requires this.

Continue reading "Configuring the Network Device Enrollment Service (NDES) to work with a domain account"

If the Network Device Enrollment Service (NDES) is newly installed (preferably without Enterprise Administrator permissions ), only the Windows-integrated authentication for the administration web page is activated at first. With this (via NT LAN Manager, NTLM) protocol, authentication via user name and password is also possible. However, not all client applications support this.

Likewise, a company might want to disable NTLM where possible and enforce Kerberos for logon . Enforcing Kerberos removes the ability to log on to the Network Device Enrollment Service administration page via username and password (since this is done with NTLM credentials). However, Basic Authentication can be retrofitted to provide an option here again.

One way out of this dilemma can be Basic Authentication, the setup of which will be explained below.

Continue reading "Enabling Basic Authentication for the Network Device Enrollment Service (NDES)"

Many companies pursue the strategy of (largely) disabling the NT LAN Manager (NTLM) authentication protocol in their networks.

This is also possible for the administration web page of the Network Device Enrollment Service (NDES). How exactly this is implemented and how this may change the application behavior is explained below.

Continue reading "Disabling NTLM and enforcing Kerberos at the Network Device Enrollment Service (NDES) administration web page"

If one installs a Network Device Enrollment Service (NDES), one is faced with the question under which identity the IIS application pool should be operated. In the following, the individual options are examined in more detail in order to facilitate a selection.

Continue reading "Selecting the identity for the IIS application pool of the Network Device Enrollment Service (NDES)"

Active Directory Certificate Services have existed (albeit under a different name) in their basic form since Windows NT 4.0. The Active Directory-based architecture used today was introduced with Windows 2000 Server. AD CS is very well integrated into the Windows ecosystem and continues to enjoy great popularity worldwide in companies and government agencies of all sizes.

People like to point out the many possibilities offered by Active Directory Certificate Services. Rarely, however, is it pointed out what is not possible with them. In fact, the product has by now reached its limits in many places.

What these are will be explained in more detail below in order to better decide whether AD CS can be the right solution for planned projects.

Continue reading "Limits of Microsoft Active Directory Certificate Services"

Assume the following scenario:

• An NDES server is configured on the network.
• When calling the NDES administration web page (certsrv/mscep_admin), logon is not possible.
• After several unsuccessful logon attempts, the following HTTP error message is returned:

401 - Unauthorized: Access is denied due to invalid credentials.
You do not have permission to view this directory or page using the credentials that you supplied.

Continue reading "Logon to the Network Device Enrollment Service (NDES) administration web page fails with HTTP error code 401 "Unauthorized: Access is denied due to invalid credentials.""

Continue reading "Details of the event with ID 86 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"

Continue reading "Details of the event with ID 87 of the source Microsoft-Windows-CertificateServicesClient-CertEnroll"