Starting NDES Services (Device Registration Service) Fails with “object does not exist”
I ran into this issue when configuring SCEP/NDES certificate registration for an Intune tenant.
Following all the best practice configuration steps, left me with an SCEP enrollment page returning Internal Server Error 500 instead of the expected 200.
I found that the Device Registration Service was not starting correctly. In the event logs I found it attempting to start and then stopping
The two most helpful event are the EventID 137
Failed to find the Device Registration Service object at DeviceRegistrationService.
Additional information
Error Message: The object does not exist..
Error Result code: NoSuchObject.
and EventID 157
An error occurred.
Additional information
Error: Failed to find the Device Registration Service object in the configuration naming context in domain contoso.com.
It’s essentially saying that the DeviceRegistrationService objects have not been successfully written to AD.
If I browse the Configuration partition of my Active Directory, I can see there is no Device Registration Configuration
And if I run the following Get-AdfsDeviceRegistration PowerShell cmdlet, I’ll get a configuration error
To fix this, run Initialize-ADDeviceRegistration
You’ll then find the Device Registration Configuration objects in your Active Directory
Start the Device Registration Service again, and all should start as expected.
Restart the NDES server just to be sure everything is talking correctly, and test the SCEP URL again. This time we should get a 200 instead of 500
Matt Shadbolt
Comments
- Anonymous
December 05, 2016
Hi,I am trying to install Microsoft NDES with customized templates:1. CEP Encryption2. Exchange Enrollment Agent (Offline Request).I have already created required users accounts in Active Directory and assigned them the required permissions as per the Microsoft's article: http://social.technet.microsoft.com/wiki/contents/articles/9063.network-device-enrollment-service-ndes-in-active-directory-certificate-services-ad-cs.aspxThough I am able to install the NDES role but it is not using the templates that I customized. It is using the default templates.I'll really appreciate if anyone can help me fix this issue.