Tag: Mobile device management (MDM)

With the May 2026 security update, Microsoft has added support for the ML-DSA algorithm in Active Directory Certificate Services.

In their documentation, they do write that NDES is not compatible with ML-DSA :

You can enroll ML-DSA certificates through the Certificates Microsoft Management Console (MMC) snap-in and certreq.exe. Enrollment through the Network Device Enrollment Service (NDES) isn't currently available.

But that's not entirely true…

Continue reading "Requesting Certificates with ML-DSA-Based Keys Through the Network Device Enrollment Service (NDES)"

Dirk-jan Mollema recently presented an attack that can be used to obtain a certificate for highly privileged accounts via Intune . This can then be used to compromise the entire Active Directory environment.

The attack is similar in its basic features to what I have already described in the article "From Zero to Enterprise Administrator through Network Device Enrollment Service (NDES) - and What to Do About It " and in the article "Attack vector on Active Directory directory service via smart card logon mechanism " (generally also known as ESC1 ).

What is new, however, is to utilize the Mobile Device Management (MDM) system - in this case Microsoft Intune - accordingly.

What is not new, however, is what can be done with the TameMyCerts Policy Module for Active Directory Certificate Services to drastically reduce the attack surface...

Continue reading "Attack on the Active Directory via Microsoft Intune - and how it can be contained with TameMyCerts"

After several postponements, Microsoft finally decided that the Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754) should now finally come into force.

Domain controllers will therefore automatically switch to full enforcement mode on February 25, 2025, unless configured otherwise. As of September 2025, it has been announced that deviating settings will no longer apply and there will therefore no longer be an alternative to full enforcement.

The consequence of this is that certificates can only be used for logon via PKInit if they have the new Security Identifier (SID) certificate extension introduced with the patch.

What at first sounds as if this is not a major problem may well become one when you consider that fewer and fewer certificate-based use cases are using classic autoenrollment these days.

How the TameMyCerts Policy Module for the Active Directory Certificate Services can help with this problem is explained in more detail in the following article.

Continue reading "Automatically add the Security Identifier (SID) certificate extension to certificates requested via Mobile Device Management (MDM) - with the TameMyCerts Policy Module for Microsoft Active Directory Certificate Services (ADCS)"

Companies use Mobile Device Management (MDM) products for managing, configuring and updating mobile devices such as smartphones, tablet computers or desktop systems via the Internet (over-the-air, OTA).

Common mobile device management products are:

• Microsoft Intune
• VMware Workspace One (previously known under the brand name AirWatch)
• Ivanti MobileIron UEM
• Jamf Pro
• Baramundi Enterprise Mobility Management
• BlackBerry Enterprise Mobility Suite
• Sophos Mobile Control
• SOTI MobiControl
• Samsung Knox
• IBM MaaS360

Continue reading "How the TameMyCerts Policy Module for Active Directory Certificate Services (ADCS) can help secure scenarios with Microsoft Intune and other Mobile Device Management (MDM) systems"

In a networked world, it has become standard to work from anywhere, and also to work with mobile end devices such as smartphones or tablets in addition to classic desktop computers. Such end devices are usually managed by Mobile Device Management (MDM) systems such as Microsoft Intune.

In most cases, users of mobile devices need digital certificates to prove their identity in order to gain access to corporate resources. Thus, it is necessary to provide these devices with an automatable yet secure interface for requesting these certificates.

Continue reading "Requesting certificates for endpoints managed with Microsoft Intune"

In a modern networked world, the confidential transmission of messages in the corporate environment is essential for business success. Despite its age , it is still impossible to imagine modern corporate communications without e-mail. However, its use has changed significantly over the decades.

Nowadays, it is common to be able to read and write business e-mails on mobile devices such as smartphones and tablets. Such end devices are usually managed with Mobile Device Management (MDM) systems such as Microsoft Intune.

To encrypt e-mail messages, companies typically use the Secure / Multipurpose Internet Message Extensions (S/MIME) standard and provide their users with the corresponding certificates. How do these certificates get to the end devices of the users in a scalable way?

Continue reading "Transferring S/MIME certificates to Microsoft Intune"

Assume the following scenario:

• An NDES server has been set up for use with Microsoft Intune.
• The configuration of the Intune Certificate Connector cannot be completed because the following error message is thrown:

Fehler bei der Microsoft Intune Certificate Connector Konfiguration. Es wurden keine Änderungen an Feature- oder Proxyeinstellungen vorgenommen.
Unerwarteter Fehler: System.ArgumentException: Die Zeichenfolge kann keine Länge von 0 (null) haben.
Parametername: name
  bei System.Security.Principal.NTAccount.ctor(String name)

Continue reading "The Certificate Connector for Microsoft Intune throws the error message "ArgumentException: String cannot be of zero length" during configuration"

With the May 10, 2022 patch, Microsoft is attempting to close a vulnerability in Active Directory that affects certificate-based logon (commonly known as PKINIT or also smart card logon ).

The update changes both the behavior of the certification authority as well as the behavior of Active Directory when processing certificate-based logons.

Continue reading "Changes to Certificate Issuance and Certificate-Based Logon to Active Directory with the May 10, 2022 Patch for Windows Server (KB5014754)"

If you want to make S/MIME certificates available to your users on the smartphone as well, you may be surprised to discover that this is not possible with the Outlook app unless you also use Microsoft Intune as a management solution for the devices.

Microsoft has now clarified in the article "Sensitivity labeling and protection in Outlook for iOS and Android " that this is due to the respective system architecture.

Continue reading "S/MIME with the Outlook app for Apple iOS and Android only possible with devices managed via Intune"

The Simple Certificate Enrollment Protocol (SCEP) was developed by Verisign for Cisco in the early 2000s to provide a simplified method for requesting certificates. Previously, network devices required manually generating a certificate request on each device, submitting it to a certification authority, and then manually installing the issued certificate on the corresponding device again.

Continue reading "Basics: Network Device Enrollment Service (NDES)"

Assume the following scenario

• A certificate request is sent to a certification authority.
• The certificate request fails with the following error message:

Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)

Continue reading "Certificate request fails with error message "Error Parsing Request The request subject name is invalid or too long. 0x80094001 (-2146877439 CERTSRV_E_BAD_REQUESTSUBJECT)"."