Installing the Network Device Enrollment Service (NDES) without Enterprise Administrator permissions
Assume the following scenario:
- One installs a Network Device Enrollment Service (NDES) server.
- The role configuration fails with the following error message:
Insufficient access rights to perform this operation. 0x80072098 (WIN32: 8344 ERROR_DS_INSUFF_ACCESS_RIGHTSTypically, the NDES role configuration requires that the installing user is a member of the Enterprise Admins group . However, this is not technically necessary and contradicts Microsoft's security hardening recommendations, since NDES is not (necessarily) a system that is assigned to the highest security layer (Tier-0).
Below is a way to configure the NDES role even without the required permissions.