Details of the event with ID 2 of the source Microsoft-Windows-NetworkDeviceEnrollmentService

Event Source:	Microsoft-Windows-NetworkDeviceEnrollmentService
Event ID:	2 (0x2)
Event log:	Application
Event type:	Error
Symbolic Name:	EVENT_MSCEP_FAILED_TO_LOAD
Event text (English):	The Network Device Enrollment Service cannot be started (%1). %2
Event text (German):	Unable to start network device registration service (%1). %2

Parameter

The parameters contained in the event text are filled with the following fields:

• %1: ErrorCode (win:UnicodeString)
• %2: ErrorMessage (win:UnicodeString)

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.

Example events

The Network Device Enrollment Service cannot be started (0x80070002). The system cannot find the file specified.

The Network Device Enrollment Service cannot be started (0x80070057). The parameter is incorrect.

The Network Device Enrollment Service cannot be started (0x80004005). Unspecified error

Description

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

The system cannot find the file specified.

The NDES service (if configured with a static password) cannot create the registration key for the encrypted password.

Can also occur when registry values are inconsistent, for example, when the "EnforcePassword" registry value is not present.

See also article "The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot be started (0x80070002). The system cannot find the file specified."„.

Can also occur if a configured policy module for NDES cannot be started. See therefore also Event no. 53.

The parameter is incorrect.

The NDES service has no usable certificates for the Registration Authority (RA), e.g. because they have not been requested, have expired, or the private keys are not available.

See also article "The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot retrieve one of its required certificates (0x80070057). The parameter is incorrect."„.

Unspecified error

The NDES service cannot communicate with the certification authority. See the article "Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot be started (0x80004005). Unspecified error".„.

Safety assessment

The security assessment is based on the three dimensions of confidentiality, integrity and availability.

If this event occurs, there is usually no breach of confidentiality, but availability is affected because no certificates can be requested through the interface.

Related links:

• Overview of Windows events generated by the Network Device Enrollment Service (NDES).

External sources

• Active Directory Certificate Services (AD CS): Network Device Enrollment Service (NDES) (Microsoft)