When calling the Network Device Enrollment Service (NDES) administration web page (certsrv/mscep_admin), one is always prompted to log in.

Assume the following scenario:

• An NDES server is configured on the network.
• The NDES server is called under a DNS alias.
• Despite entering the correct login data, you are always prompted to log in again when you access the NDES administration web page (certsrv/mscep_admin).

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.

The error occurs because authentication fails. Possible causes can be:

• If a CNAME record is used as an alias for the NDES login page address, authentication fails when logging in to the NDES administration web page via Kerberos, i.e. the accessed address does not match the Service Principal Name (SPN). The solution in this case is to use an A-record instead of a CNAME.
• If the NDES server uses a Domain account or a Group Managed Service Account (gMSA), kernel mode authentication must be disabled in IIS, otherwise the service tickets cannot be decrypted.

Related links:

• Login to the Network Device Enrollment Service (NDES) administration web page fails with HTTP error code 401 "Unauthorized: Access is denied due to invalid credentials."
• Configuring the Network Device Enrollment Service (NDES) to work with a domain account.
• Configuring the Network Device Enrollment Service (NDES) to work with a Group Managed Service Account (gMSA).