The Certificate Connector for Microsoft Intune throws the error message "ArgumentException: String cannot be of zero length" during configuration.

Assume the following scenario:

• An NDES server has been set up for use with Microsoft Intune.
• The configuration of the Intune Certificate Connector cannot be completed because the following error message is thrown:

Error in Microsoft Intune Certificate Connector configuration. No changes were made to feature or proxy settings.
Unexpected error: System.ArgumentException: The string cannot have a length of 0 (zero).
Parameter name: name
  for System.Security.Principal.NTAccount.ctor(String name)

Cause and solution

Do you know TameMyCerts? TameMyCerts is an add-on for the Microsoft certification authority (Active Directory Certificate Services). It extends the function of the certification authority and enables the Application of regulationsto realize the secure automation of certificate issuance. TameMyCerts is unique in the Microsoft ecosystem, has already proven itself in countless companies around the world and is available under a free license. It can downloaded via GitHub and can be used free of charge. Professional maintenance is also offered.

The error appears at the end of the Certificate Connector installation and occurs only if the "SCEP" option was selected during configuration.

Tests have shown that Intune for NDES not is usable with the IIS application pool identity, but absolutely requires a domain account for the "SCEP" IIS application pool identity.

Fits this, that Group Managed Service Accounts (gMSA) are also not supported:

While the NDES role can be configured to run using a GMSA, the Intune Certificate Connector was not designed nor tested using a GMSA and is considered an unsupported configuration.

The solution is therefore the Configuring NDES to use a domain account.

Related links:

• Configuring the Network Device Enrollment Service (NDES) to work with a domain account.

External sources

• Certificate Connector for Microsoft Intune (Microsoft Corporation)
• Configure infrastructure to support SCEP with Intune (Microsoft Corporation)