| Event Source: | Microsoft-Windows-NetworkDeviceEnrollmentService |
| Event ID: | 3 (0x3) |
| Event log: | Application |
| Event type: | Information |
| Event text (English): | The Network Device Enrollment Service has been stopped. |
| Event text (German): | The network device registration service has been terminated. |
The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.
Example events
The Network Device Enrollment Service has been stopped.
Description
Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.
This event occurs when the network device registry service is terminated, more specifically when mscep.dll is unloaded, for example, when the IIS service or the MSCEP application pool is terminated or restarted.
May also occur on its own if the NDES service does not receive any requests for an extended period of time.
Safety assessment
The security assessment is based on the three dimensions of confidentiality, integrity and availability.
If this event occurs without the corresponding counter event "The Network Device Enrollment Service started successfully." (Event #1), the service is disabled and is not usable. However, it is difficult to monitor this technically, since the start event is only triggered the first time a client calls it.
English 
Deutsch