| Event Source: | Microsoft-Windows-NetworkDeviceEnrollmentService |
| Event ID: | 3 (0x3) |
| Event log: | Application |
| Event type: | Information |
| Event text (English): | The Network Device Enrollment Service has been stopped. |
| Event text (German): | The network device registration service has been terminated. |
The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.
Example events
The Network Device Enrollment Service has been stopped.
Description
This event occurs when the network device registry service is terminated, more specifically when mscep.dll is unloaded, for example, when the IIS service or the MSCEP application pool is terminated or restarted.
May also occur on its own if the NDES service does not receive any requests for an extended period of time.
Safety assessment
The security assessment is based on the three dimensions of confidentiality, integrity and availability.
If this event occurs without the corresponding counter event "The Network Device Enrollment Service started successfully." (Event #1), the service is disabled and is not usable. However, it is difficult to monitor this technically, since the start event is only triggered the first time a client calls it.
English 
Deutsch