Common Network Device Enrollment Service (NDES) configuration wizard failures

Hey all! Rob Greene here. We see cases around Network Device Enrollment Service (NDES) failing to successfully complete.

Please keep in mind that you can get these error messages outside of NDES installation, however we are not going to be covering those errors within this blog. This blog is going to concentrate on the assumption that everything is working fine in general with regards to issuing certificates within the environment, but the NDES configuration wizard is failing.

The most often encountered errors by customers are:

• Access Denied
  
• RPC Communication
  
• AD CS Service Stop / Start
  

Access Denied Message

The first error message is the dreaded Access Denied error message while running through the wizard like the one below.

Or if looking at the deployment operational logs:

Event Viewer\Application and Services Logs\Microsoft\Windows\CertificateServices-Deployment\Operational

There are several tasks that are happening when going through the configuration wizard, and most of these tasks require an elevated account. Due to this account elevation requirement, if Access Denied is being seen during the configuration, it will mean that the account running the wizard does not have the required permissions.

Here is the list of tasks that are done:

1. Modify the permissions on the certificate template named: IPSec(Offline request). It adds the Application Pool Identity account that was specified in the NDES configuration wizard with Enroll permissions for the template.
   

1. Modify the CertificateTemplates attribute on the CA's pKIEnrollmentService object. The object is in the Configuration partition (CN=CA NAME,CN=Enrollment Services,CN=Public Key Services,CN=Services,CN=Configuration,DC=Forest Root Domain) of the CA it is targeting. The following template names are added the CertificateTemplates attribute: IPSECIntermediateOffline, CEPEncryption, and EnrollmentAgentOffline.
   

1. Stop and Start of the Active Directory Certificate Services service on the certification authority (CA) computer.
   

If any of these tasks fail, you will see the error message of Access Denied. So, the first thing to check is to ensure that the account used to run the NDES configuration wizard can do each of these tasks independently of the wizard.

How RPC communications works.

When an RPC / DCOM based client application wants to connect to the RPC/DCOM application it first contacts the RPC Endpoint Mapper and asks to be given the port number for the RPC/DCOM application via the UUID information. The endpoint mapper looks this information up and then returns the high port that the RPC / DCOM application gave it. Then the RPC / DCOM client application attempts to connect to the high port given to it by the RPC endpoint mapper.

For more information on RPC and how it works see this:

RPC error troubleshooting guidance - Windows Client

The RPC server is unavailable (RPC_S_SERVER_UNAVAILABE) – 0x800706ba / 1722

When not an Access Denied, this is the other most often seen error, when running the configuration wizard.

The RPC Server is unavailable. 0x800706ba (WIN32: 1722 RPC_S_SERVER_UNAVAILABLE) dialog box.

The event log entry for this is going to look something like the below:

This type of error will come from a few different scenarios.

DCOM Permissions / Hardening Mismatch issues:

Ports being blocked by Firewalls

Service Control Manager times out waiting for AD CS Service to Stop and Start

As stated earlier, the NDES configuration wizard needs to be able to successfully stop and start the AD CS Service on the Certification Authority server. If you can stop and start the service, you can still fail to configure NDES, if the AD CS Service cannot be stopped and started within a 30-second window.

NDES stops and starts the service via the Service Control Manager (SCM) APIs. If you have ever attempted to stop/start a service and noticed it does not stop/start quickly, you might see a message stating that Service Control Manager cannot tell you if it the service was successfully stopped / started, as it did not report back in a timely fashion. Well, SCM will only wait 30 seconds for the service to return the status of the stop/start command it sent to it. SCM stops worrying about the service when it takes longer than 30 seconds.

NDES first sends the stop command to SCM for AD CS, then uses SCM to find out when the service is successfully stopped. the start command to SCM for AD CS and again uses SCM to find out when the service is successfully started.

We typically see this fail in the following two scenarios:

1. The AD CS Service uses a Hardware Storage Module (HSM), and AD CS service does not start quickly because it requires the use of Operator Cards or communications with the HSM is latent.
   
2. The AD CS Service just takes a long time to stop and start. This happens typically because an AD CS Auditing setting was enabled on the Certification Authority. The auditing setting is: Start and stop Active Directory Certificate Services.
   
   1. 
      
   2. Launch CertSrv.msc
      
   3. Right click on the CA’s computer object and select Properties.
      
   4. Click on the Auditing tab.
      
   5. Uncheck “Start and stop Active Directory Certificate Services”
      
   6. Click the OK button.
      
   7. In an elevated command prompt type: Net Stop CertSvc & Net Start CertSvc
      

Depending on how long the service takes to stop and start with either or both these issues, the Service Control Manager (SCM) can be modified to wait longer than the default 30 seconds. See this WIKI content.

Event ID 7011: Service Timeout - TechNet Articles - United States (English) - TechNet Wiki (microsoft.com)

Increase the service timeout period for Service Control Manager (SCM)

The Service Control Manager will generate an event if a service does not respond within the defined timeout period (the default timeout period is 30000 milliseconds). To resolve this problem, use the Registry Editor to change the default timeout value for all services.

To perform this procedure, you must have membership in the Administrators group, or you must have been delegated the appropriate authority.

Caution: Incorrectly editing the registry may severely damage your system. Before making changes to the registry, you should back up any valued data.

To change the service timeout period:

1. Click the Start button, then click Run, type regedit, and click OK.
   
2. In the Registry Editor, click the registry subkey HKLM\SYSTEM\CurrentControlSet\Control.
   
3. In the details pane, locate the ServicesPipeTimeout entry, right-click that entry and then select Modify. Note: If the ServicesPipeTimeout entry does not exist, you must create it by selecting New on the Edit menu, followed by the DWORD Value, then typing ServicesPipeTimeout, and clicking Enter.
   
4. Click Decimal, enter the new timeout value in milliseconds and then click OK.
   
5. Restart the computer.
   

If you have one of these errors I hope that this was able helpful in determining what was going on and helped in resolving the issue for you.

Continue reading...