Requesting certificates through the Network Device Enrollment Service (NDES) fails with HTTP error code 503 and there are no entries in the Event Viewer

Author Uwe GradeneggerPosted on Categories Network Device Registration Service (NDES), TroubleshootingTags , ,

Assume the following scenario:

  • A network device enrollment service (NDES) is implemented in the network.
  • The NDES server uses a domain account or a Group Managed Service Account (gMSA) for the identity of the SCEP IIS application pool.
  • Requesting certificates via NDES fails with HTTP error code 503 (Server Unavailable).
  • Calling the mscep and mscep_admin pages also fails with HTTP error code 500.
  • Even after an iisreset or restart of the NDES server, no event appears after calling the mscep or mscsp_admin page that the NDES service has started or that there were errors.

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.

Possible causes:

This error occurs, among others, if the service account under which the SCEP application pool is running does not have the following rights:

This may be the case, among others, when hardening guidelines have been applied, such as the official Microsoft Security Baselines. See article "Required Windows security permissions for the Network Device Enrollment Service (NDES)„.

Related links:

en_USEnglish
de_DEDeutsch en_USEnglish