The Certificate Connector for Microsoft Intune throws the error message "ArgumentException: String cannot be of zero length" during configuration

Assume the following scenario:

An NDES server has been set up for use with Microsoft Intune.
The configuration of the Intune Certificate Connector cannot be completed because the following error message is thrown:

Fehler bei der Microsoft Intune Certificate Connector Konfiguration. Es wurden keine Änderungen an Feature- oder Proxyeinstellungen vorgenommen.
Unerwarteter Fehler: System.ArgumentException: Die Zeichenfolge kann keine Länge von 0 (null) haben.
Parametername: name
  bei System.Security.Principal.NTAccount.ctor(String name)

Cause and solution

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

The error appears at the end of the Certificate Connector installation and occurs only if the "SCEP" option was selected during configuration.

Tests have shown that Intune for NDES not is usable with the IIS application pool identity, but absolutely requires a domain account for the "SCEP" IIS application pool identity.

Fits this, that Group Managed Service Accounts (gMSA) are also not supported:

While the NDES role can be configured to run using a GMSA, the Intune Certificate Connector was not designed nor tested using a GMSA and is considered an unsupported configuration.

The solution is therefore the Configuring NDES to use a domain account.

One thought on “Der Certificate Connector für Microsoft Intune wirft bei der Konfiguration die Fehlermeldung „ArgumentException: String cannot be of zero length“”

Pingback: Identity selection for the IIS application pool of the Network Device Enrollment Service (NDES) - Uwe Gradenegger

Comments are closed.

The Certificate Connector for Microsoft Intune throws the error message "ArgumentException: String cannot be of zero length" during configuration.

Cause and solution

Related links:

External sources

One thought on “Der Certificate Connector für Microsoft Intune wirft bei der Konfiguration die Fehlermeldung „ArgumentException: String cannot be of zero length“”