NDES and SCEP

[lmrogers]

Morning

 

I've had Intune deploying certs for always on vpn authentication working well but today I've got a couple of computers that now will no long pickup the certificate.

 

I followed this guide to setup the NDES and SCEP deployment previously: https://techcommunity.microsoft.com/t5/intune-customer-success/support-tip-how-to-configure-ndes-for-scep-certificate/ba-p/455125

 

Now I am getting this error on the clients:

 

SCEP Certificate enrollment for Local system via https://xxxx.msappproxy.net/certsrv/mscep/mscep.dll/pkiclient.exe failed:

PkiStatus(2): SCEPDispositionFailureFailInfo(2): SCEPFailBadRequestEnrollStatus(256): EnrollDeniedElement not found. 0x80070490 (WIN32: 1168 ERROR_NOT_FOUND)ProcessResponseMessageSubmit(Request): HTTP/1.1 200 Date: Thu, 01 Apr 2021 10:02:02 GMTContent-Length: 721Content-Type: application/x-pki-messageSet-Cookie: AzureAppProxyAnalyticCookie_2e4403a3-1918-4ce0-aaf2-e752fa9d6863_1.3=3|qzY7bL/WLLHXmlj5B8Ep9twHqojNPYrNavM/iOobspl+Ac1wt6jC9PqFstewofZ10P0u0moD2qwC6Dba20LXLxelotl9/MF0cD1ujohYNmnLj/jtn2w8hrhtms77R5zxnAGYT1icFIi1bLl9xtlX7g==; path=/; Secure; SameSite=Nonex-ms-proxy-app-id: 2e4403a3-1918-4ce0-aaf2-e752fa9d6863x-ms-proxy-group-id: 5e7fb653-6fe5-45c6-b365-4d39c87c6726x-ms-proxy-subscription-id: 064b53d9-40d8-4867-b493-2e949a06ed13x-ms-proxy-transaction-id: 3fa707f7-0ee5-4042-8f69-1a28c13b515ax-ms-proxy-service-name: proxy-appproxy-NEUR-DUB02P-2x-ms-proxy-data-center: NEURx-ms-proxy-connector-id: 54059fe0-81be-4023-9c48-1a6a9cd26374x-powered-by: ASP.NETNel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}Report-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://ffde.nelreports.net/api/report?cat=proxy-appproxy-NEUR-DUB02P-2"}]}Method: POST(3594ms)Stage: ProcessResponseMessageElement not found. 0x80070490 (WIN32: 1168 ERROR_NOT_FOUND)

 

I've tried what I can find on Google but still not been able to resolve. Just wondering if I have missed anything obvious or if anyone has had similar issues

 

Cheers

[Norphy]

Have its CEP Encryption and Exchange Enrollment Agent certificates expired? Check the local certificate store on the server holding the NDES role.

 

The easiest way to fix it if they have is to re-install the NDES role.

[sparkeh]

Haven’t seen that error before but there’s some things I would check:

 

1) Have you got any intermediate certs in the Trusted Root Certification Authorities certificate store? That can cause all manner of oddness. Check visually or run the following PS:

 

Get-Childitem -Path cert:\LocalMachine\root -Recurse | Where-Object {$_.Issuer -ne $_.Subject}

 

2) Double check all your certs are valid

 

3) Check the NDESPlugin.log on the NDES server as this might give you more of a clue about why it’s failing