Introduction
This documentation states the procedure to troubleshoot the errors during user enrolment while SCEP configuration is enabled.
Step 1: Validate AD broker logs
- AD Broker logs show the detailed flow of user enrollment with SCEP enabledSCEP-enabled.
- Every successful enrollment displays the ScepEnroll success message.
- Success scenario logs
- ScepEnroll challenge url: http://xx.xx.xx.xx/CertSrv/mscep_admin agent: ndes
- ScepEnroll ntlm getPassword success
- ScepEnroll success returning payload.
- ScepEnroll pkiStatus=SUCCESS AD server returned a certificate
- Failure scenario logs
- NTLM GetPassword returned bad password, verify SCEP agent password/configuration
- ScepEnroll challenge url: http://xx.xx.xx.xx/CertSrv/mscep_admin agent: ndes
- getEntries ScepEnroll failed: NTLM GetPassword returned bad password, verify SCEP agent password/configuration
Step 2: Validate the NDES server events logs
- Open the Server Manager window on the NDES server
- Navigate to Tools > Event Viewer
- Windows Logs > Application > Filter Current Log > Event Sources as "NetworkDeviceEnrollmentService"
- Click OK
- Check if any errors are present in the event log
- Failure Scenario log
- The Network Device Enrollment Service cannot retrieve information about the certification authority (0x80004005). Unspecified error
- The Network Device Enrollment Service cannot be started (0x80070057)
Step 3: Validate the NDES server and CA server connectivity.
- Open a command prompt as administrator in NDES server
- Type “certutil -ping {ca-hostname}” and press enter
- Verify that the connectivity is present between NDES server and CA server
- Failure Scenario Log
- ERROR_ACCESS_DENIED
- ERROR_ACCESS_DENIED
- RPC_S_SERVER_UNAVAILABLE
Step 4: Validate the msecp_admin website running status in IIS.
- Open the Server Manager window on the NDES server
- Tools > Internet Information Services (IIS) Manager
- Sites > Default Web Site
Step 5: Validate the ndes service account permissions on the Smartcard logon template.
- Open the Server Manager window on the NDES server
- Tools > Certificate Authority
- Right-click on certificate templates > Manage
- Smartcard Logon Properties > Security
Was this article helpful?
That’s Great!
Thank you for your feedback
Sorry! We couldn't be helpful
Thank you for your feedback
Feedback sent
We appreciate your effort and will try to fix the article