Tag: Group managed service account (gMSA)

Assume the following scenario:

• An NDES server has been set up for use with Microsoft Intune.
• The configuration of the Intune Certificate Connector cannot be completed because the following error message is thrown:

Fehler bei der Microsoft Intune Certificate Connector Konfiguration. Es wurden keine Änderungen an Feature- oder Proxyeinstellungen vorgenommen.
Unerwarteter Fehler: System.ArgumentException: Die Zeichenfolge kann keine Länge von 0 (null) haben.
Parametername: name
  bei System.Security.Principal.NTAccount.ctor(String name)

Continue reading "The Certificate Connector for Microsoft Intune throws the error message "ArgumentException: String cannot be of zero length" during configuration"

If one installs a Network Device Enrollment Service (NDES), one is faced with the question under which identity the IIS application pool should be operated. In the following, the individual options are examined in more detail in order to facilitate a selection.

Continue reading "Selecting the identity for the IIS application pool of the Network Device Enrollment Service (NDES)"

For security reasons, it may make sense to operate the CES with a Group Managed Service Account (gMSA) instead of a normal domain account. This option offers the charming advantage that the password of the account is changed automatically, and thus this step does not have to be done manually, which is unfortunately forgotten far too often.

Continue reading "Configure the Certificate Enrollment Web Service (CES) to work with a Group Managed Service Account (gMSA)"

Assume the following scenario:

• A Certification Authority Web Enrollment (CAWE) server is installed on the network.
• The role is installed on a separate server, not on the certification authority directly.
• A user attempts to request a certificate via Certification Authority Web Enrollment or submit an existing certificate request to the certification authority.
• The request fails with the following error message:

Your request failed. An error occurred while the server was processing your request. Contact your administrator for further assistance.

In the details of the error message you will find the following note:

CCertRequest::Submit: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)

Continue reading "Requesting a certificate via Certification Authority Web Enrollment (CAWE) fails with error code "ERROR_ACCESS_DENIED""

For security reasons, it may make sense to operate the CAWE with a Group Managed Service Account (gMSA) instead of a normal domain account. This option offers the charming advantage that the password of the account is changed automatically, and thus this step does not have to be done manually, which is unfortunately forgotten far too often.

Continue reading "Configure Certification Authority Web Enrollment (CAWE) for use with a Group Managed Service Account (gMSA)"

For security reasons, it may make sense to operate the CEP with a group managed service account (gMSA) instead of a normal domain account. This option offers the charming advantage that the password of the account is changed automatically, and thus this step does not have to be done manually, which is unfortunately forgotten far too often.

Continue reading "Configure the Certificate Enrollment Policy Web Service (CEP) to work with a group managed service account (gMSA)"

For security reasons, it may make sense to operate NDES with a Group Managed Service Account (gMSA) instead of a normal domain account. This option offers the charming advantage that the password of the account is changed automatically, and thus this step does not have to be done manually, which is unfortunately forgotten far too often.

Continue reading "Configuring the Network Device Enrollment Service (NDES) to work with a Group Managed Service Account (gMSA)"