Unable to install Network Device Enrollment Service (NDES) at a site with only read-only domain controllers

Author Uwe Gradenegger Posted on Categories Troubleshooting, Network Device Enrollment Service (NDES), Active Directory Tags Read-only domain controller

Assume the following scenario:

  • A Network Device Enrollment Service (NDES) is to be implemented in the network.
  • Only read-only domain controllers (RODC) are located at the Active Directory site of the NDES server.
  • NDES role configuration fails with the following error message:
Failed to add the following certificate templates to the enterprise Active Directory Certificate Service or update security settings on those templates:
EnrollmentAgentOffline 
CEPEncryption
IPSEC(Offline request)
A referral was returned from the server. 0x8007202b (WIN32:8235 ERROR_DS_REFERRAL)

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Basics: Network Device Enrollment Service (NDES) ".

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the application of rule sets to realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can be downloaded via GitHub and used free of charge. Professional maintenance is also offered.

The NDES installation routine modifies, among other things, the certificateTemplates attribute on the pKIEnrollmentService object of the selected certification authority.

For such operations, read-only domain controllers merely refer the client to writable domain controllers. It is therefore the task of the client (in this case the NDES installation routine) to also follow this referral, but this is not done in this case (since it is not implemented).

Once again you can see that NDES has not been further developed since Windows Server 2003 and that the Active Directory Certificate Services require more and more workarounds as they get older.

One possible solution is to install the Network Device Enrollment Service (NDES) without Enterprise Administrator permissions , since the required adjustments can be made manually or omitted in this case.

External sources