Intune SCEP Certs Not Deploying? Here's How to Troubleshoot It

Updated: 13 Jan, 2025 • 0 • min read

Table of Contents

Having trouble getting your Intune SCEP certificates to deploy? Don’t worry, we’ve got you covered. This guide will walk you through troubleshooting the NDES reporting process, so you can get those certs rolled out smoothly.

Intune SCEP Certs
image just illustration

Understanding the Problem: Why Aren’t My Certs Deploying?¶

When you use SCEP certificate profiles to give certificates to your Windows devices, the final step is for the Intune Certificate Connector to report back to Intune. Sometimes, this reporting process hiccups, and your certificates seem to get stuck in limbo. This guide focuses on making sure NDES and the Intune Certificate Connector are doing their job and correctly reporting certificate delivery.

Checking the Logs: Where to Look for Clues¶

The first step in troubleshooting is checking the logs on your NDES server. These logs hold valuable information about what’s happening behind the scenes. Here’s where to look and what to look for:

IIS Log: Look for entries like this: fe80::f53d:89b8:c3e8:5fec%13 POST /CertificateRegistrationSvc/Certificate/Notify - 443 - fe80::f53d:89b8:c3e8:5fec%13 NDES_Plugin - 204 0 0 277 62. This indicates a successful notification.
NDESPlugin.log: This log should contain entries similar to:
```
Calling Notifyrequest ...
Sending request to certificate registration point.
Exiting Notify with 0x0
```
The “Exiting Notify with 0x0” is what you want to see – it signifies a successful exit from the notification process.
CertificateRegistrationPoint.svclog & NDESConnector.svclog: These logs provide more detailed information about the certificate registration and connector processes. Check them for any error messages or unusual activity.
CertificateRequestStatus Folder: This is the gold mine! Navigate to %ProgramFiles%\\Microsoft Intune\\CertificateRequestStatus. You’ll find three folders: Failed, Processing, and Succeed. Successfully processed certificates will have corresponding files in the Succeed folder. Open these files with Notepad to see the data uploaded to Intune, including details like CertificateSerialNumber, UserID, DeviceID, and Thumbprint.

Dealing with Stuck Files: What to Do When Things Go Wrong¶

If you’re not seeing new files appearing in the Succeed folder, it’s time to investigate further. The most common culprit is files getting stuck in the Processing folder.

Here’s how to handle it:

Check the Intune Connector Service: Make sure the Intune Connector Service is running on your NDES server. If it’s not, start it up.
Examine the Ndesconnector.svclog: Look for any error messages in this log. These errors can point you towards the root cause of the problem.
Restart the Services: Sometimes, a simple restart of the Intune Connector Service and/or the NDES service can resolve the issue.
Check Network Connectivity: Ensure that the NDES server has proper network connectivity to the Intune service. Firewall issues or DNS problems can prevent communication.

Deeper Dive: Common Issues and Solutions¶

Here are a few more specific scenarios and how to address them:

Missing Log Entries: If you’re not seeing any log entries related to certificate reporting, double-check that logging is enabled for all relevant components.
Firewall Interference: Make sure your firewall isn’t blocking communication between the NDES server and the Intune service.
Incorrect Configuration: Review your SCEP profile settings and ensure everything is configured correctly, including the URL for the NDES server.
Certificate Authority Issues: Problems with your Certificate Authority (CA) can also prevent certificate issuance. Check the CA logs for any errors.

Wrapping Up: Get Those Certs Deployed!¶

Troubleshooting Intune SCEP certificate deployments can be a bit tricky, but by systematically checking the logs and following these steps, you should be able to identify and resolve the issue. Remember, the CertificateRequestStatus folder is your friend! Keep an eye on it to see the progress of your certificate deployments.

We hope this guide has helped you get your Intune SCEP certs rolling. If you’re still having trouble or have any questions, please leave a comment below, and we’ll do our best to assist you. We encourage you to share your own experiences and tips – your insights could help others facing similar challenges. Come back and visit us again for more helpful guides and information!

Computacionvinchi