Assume the following scenario
- One installs a Network Device Enrollment Service (NDES) server
- The role configuration fails with the following error message:
CMSCEPSetup::SetMSCEPSetupProperty: Access is denied. 0x80070005 (WIN32: 5 ERROR_ACCESS_DENIED)
The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.
Cause
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem and is available under a free license. It can downloaded via GitHub and can be used free of charge.
This error occurs when the user configuring the NDES role does not have "Manage CA" permission on the certificate authority.
In the default configuration, the Enterprise Admins group has this permission, and membership in this group is a prerequisite for installing NDES.
However, there are also an unofficial wayto be able to install NDES without Enterprise Administrator permissions.
English 
Deutsch