Details of the event with ID 18 of the source Microsoft-Windows-NetworkDeviceEnrollmentService
| Event Source: | Microsoft-Windows-NetworkDeviceEnrollmentService |
| Event ID: | 18 (0x12) |
| Event log: | Application |
| Event type: | Error |
| Symbolic Name: | EVENT_MSCEP_FAIL_TO_DECRYPT_INNER |
| Event text (English): | The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (%1). %2 |
| Event text (German): | Die PKCS7-Nachricht (%1) des Clients kann vom Registrierungsdienst für Netzwerkgeräte nicht entschlüsselt werden. %2 |
Parameter
The parameters contained in the event text are filled with the following fields:
- %1: ErrorCode (win:UnicodeString)
- %2: ErrorMessage (win:UnicodeString)
The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics ".
Example events
The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (0x80070005).
The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (0x80090020). An internal error occurred.
The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (0x80090008). Invalid algorithm specified.
The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (0x80090011). Object was not found.
The Network Device Enrollment Service cannot decrypt the client's PKCS7 message (0x80090005). Bad Data.Description
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.
Occurs when the PKCS#7 message sent by the SCEP client to the Network Device Enrollment Service cannot be decrypted.
Error code "Bad Data" (0x80090005)
This may be the case, for example, if the Registration Authority Certificates have been renewed recently and messages were still encrypted with the key of the previous CEP Encryption certificate. This in turn can occur if, for example, the certificate enrollment was performed with the SSCEP client and the Registration Authority certificates were not retrieved again.
See also article "Requesting certificates via Network Device Enrollment Service (NDES) fails with HTTP error code 500 ".
Error codes "An internal error occurred" (0x80090020) and "Invalid algorithm specified" (0x80090008)
This can occur if the NDES server (or its CEP encryption certificate) does not support the encryption algorithm used by the client.
This can occur in particular when the client (e.g., BlackBerry Enterprise Mobility Suite) enforces the Advanced Encryption Standard (AES) algorithm, and the NDES server uses certificates with a hardware security module whose Cryptographic Service Provider does not understand AES.
Error code "Object was not found" (0x80090011)
This error may occur if the NDES server uses a hardware security module (HSM) and communication with it is disrupted.
Security assessment
The security assessment is based on the three dimensions of confidentiality, integrity and availability.
Availability may be affected, so this event should be investigated.
Related links:
- Overview of Windows events generated by the Network Device Enrollment Service (NDES).
- Basics: Cryptographic Service Provider (CSP) and Key Storage Provider (KSP)
- Cryptographic Hardening of SCEP Transactions for the Network Device Enrollment Service (NDES)