Troubleshooting NDES Certificate Installation Error 0x80090014 in Intune

Table of Contents

When deploying the Network Device Enrollment Service (NDES) connector for Microsoft Intune, administrators occasionally encounter issues that prevent successful installation. One common and particularly vexing error manifests during the certificate installation phase, specifically when the NDES certificate itself fails to install. This problem directly impacts the ability to provision SCEP (Simple Certificate Enrollment Protocol) certificates to managed devices through Intune, thus hindering secure access to corporate resources.

This article aims to provide a comprehensive guide to understanding, diagnosing, and resolving the 0x80090014 error that surfaces during the NDES certificate installation. We will delve into the underlying causes, with a particular focus on certificate template versions, and offer detailed, actionable steps to ensure a smooth and successful NDES connector deployment. By following these guidelines, you can effectively overcome this hurdle and strengthen your organization’s device security posture.

Understanding NDES and Its Role with Intune¶

The Network Device Enrollment Service (NDES) plays a critical role in a Public Key Infrastructure (PKI) designed for mobile device management. Specifically, NDES facilitates the enrollment of certificates for devices and users using the Simple Certificate Enrollment Protocol (SCEP). In the context of Microsoft Intune, NDES acts as an intermediary, allowing Intune to request certificates on behalf of managed devices from your on-premises Certificate Authority (CA).

This setup is essential for implementing certificate-based authentication, which offers a highly secure method for devices to access Wi-Fi, VPNs, and other corporate resources without requiring users to manually enter credentials. The NDES connector bridges the gap between your Intune tenant in the cloud and your on-premises CA, ensuring that SCEP certificate requests are securely processed and fulfilled. A correctly configured NDES server, including its own operational certificate, is therefore foundational for Intune’s SCEP certificate deployment capabilities.

Symptoms of Error 0x80090014¶

The primary symptom of this issue is the failure to install the NDES certificate during the NDES connector setup process for Intune. Despite proceeding with the installation, the necessary certificate for the NDES service’s operation is not successfully provisioned. This blockage prevents the NDES connector from functioning correctly, rendering it unable to process certificate requests from Intune.

Upon reviewing the setup logs, specifically the SetupMSI.log file typically located at C:\NDESConnectorSetup\SetupMSI.log, you will find specific error entries. These entries provide crucial diagnostic information, pointing directly to the root cause of the installation failure. The relevant log snippet will clearly indicate a cryptographic operation failure, leading to the premature termination of the installation.

The following log entries are characteristic of this problem:

SI (s) (64:4C) [time]: Invoking remote custom action. DLL: C:\Windows\Installer\MSID8CB.tmp, Entrypoint: AddNDESToCertPrivKey
AddNDESToCertPrivKey: Giving read access to the accountAccountNameon the private key of the cert with thumbprint:ThumbPrint
AddNDESToCertPrivKey: Error 0x80090014: CryptAcquireContext failed. Error hr = 80090014lx
CustomAction AddNDESToCertPrivKey returned actual error code 1603

This sequence indicates that the installation process attempted to grant read access to the NDES service account on the private key of a certificate but failed during the CryptAcquireContext operation. The error code 0x80090014 specifically points to an issue with acquiring a handle to a cryptographic service provider (CSP) or key storage provider (KSP), which is necessary to access cryptographic keys. This often suggests a problem with the cryptographic capabilities or configuration of the certificate being used or requested.

Deeper Dive into Error Code 0x80090014¶

The error code 0x80090014, or NTE_KEYSET_NOT_DEF (Keyset not defined), is a common cryptographic error that signifies a failure to access or create a cryptographic key container. This can occur for several reasons, but in the context of NDES certificate installation, it most frequently points to an incompatibility or misconfiguration related to the certificate’s cryptographic properties. Essentially, the system is unable to initialize the cryptographic context needed to interact with the certificate’s private key.

Common reasons for this error include:
* Incorrect Cryptographic Service Provider (CSP) or Key Storage Provider (KSP) specified: The certificate might have been issued with a specific CSP/KSP that is not available or compatible on the NDES server, or the request process implicitly chose an incompatible one.
* Permissions on the key container: Although the log entry indicates an attempt to grant permissions, the underlying issue might be that the key container itself cannot be accessed or created due to permissions or a corrupt state.
* Unsupported cryptographic algorithms or key sizes: Older certificate templates or misconfigured templates might specify cryptographic parameters that are not fully supported or are deprecated, leading to failures in modern cryptographic operations.
* Certificate template version: This is the most prevalent cause in the NDES context. Older “Version 1” certificate templates often rely on legacy Cryptographic Service Providers (CSPs) that can cause issues, especially with modern server operating systems or specific applications like the Intune NDES connector.

Understanding these potential causes is crucial for effective troubleshooting. While permissions are always a consideration, the specific NDES installation context often points to the certificate template itself as the primary culprit, leading us directly to the recommended solution.

The Solution: Utilizing a Version 2 Certificate Template¶

The definitive solution to the 0x80090014 error during NDES certificate installation for Intune is to ensure that the NDES server certificate is created using a Version 2 (V2) certificate template. Version 2 templates offer enhanced cryptographic flexibility and support for Key Storage Providers (KSPs), which are the modern replacement for legacy Cryptographic Service Providers (CSPs).

Version 1 templates typically default to legacy CSPs, which can lead to compatibility issues with contemporary applications and operating systems. These legacy CSPs may not correctly handle certain operations or permissions assignments, resulting in errors like CryptAcquireContext failed. By contrast, Version 2 templates allow for the explicit selection of a KSP, such as the Microsoft Software Key Storage Provider, which is fully compatible with modern Windows environments and the NDES connector. This ensures that cryptographic operations involving the certificate’s private key can proceed without encountering definition or access errors.

Key Differences: V1 vs. V2 Certificate Templates¶

To grasp why V2 templates are essential, let’s briefly compare them:

Feature	Version 1 Template	Version 2 Template
Cryptography Provider	Primarily relies on legacy Cryptographic Service Providers (CSPs) like “Microsoft RSA SChannel Cryptographic Provider”.	Supports both CSPs and modern Key Storage Providers (KSPs).
Customization	Limited configuration options.	Extensive customization options, including enhanced key usages, application policies, and more granular security settings.
OS Compatibility	Best suited for Windows 2000/2003 CAs and older clients.	Required for Windows Server 2008 and later CAs; offers broader compatibility with modern clients and services.
Private Key Options	Simpler handling of private keys.	Advanced options for private key protection, exportability, and more robust key generation.
Security	Uses older cryptographic mechanisms.	Leverages stronger, more modern cryptographic algorithms and security practices.

The crucial difference for the 0x80090014 error lies in the cryptography provider. V2 templates allow for the configuration of modern KSPs, which resolve the underlying CryptAcquireContext issue by providing a robust and compatible cryptographic interface.

Prerequisites for NDES Connector Installation¶

Before diving into the detailed steps for creating and applying a V2 certificate template, it’s important to ensure all fundamental prerequisites for NDES and Intune connector are met. Neglecting these can lead to further issues, even if the certificate template is correctly configured.

1. Dedicated NDES Server: A server dedicated solely to NDES is recommended. This server should not be a Domain Controller or a Certificate Authority (CA).
2. Server Operating System: Windows Server 2012 R2 or later (Windows Server 2016, 2019, 2022 are preferred).
3. Active Directory Domain Membership: The NDES server must be joined to your Active Directory domain.
4. Enterprise Certificate Authority (CA): A properly configured Enterprise CA is required. The NDES server must be able to communicate with this CA.
5. NDES Service Account: A dedicated service account for NDES is recommended. This account needs specific permissions:
   • Read, Enroll, Autoenroll permissions on the SCEP certificate templates.
   • Request Certificates permission on the CA.
   • Deny logon locally and Deny logon through Remote Desktop Services rights should generally NOT be applied to this account.
   • Member of the local IIS_IUSRS group.
6. IIS Role Installation: The Web Server (IIS) role must be installed on the NDES server, with specific sub-components like CGI and ASP.NET.
7. Network Connectivity: Ensure proper network connectivity between the NDES server, your CA, and the Intune connector machine (if separate). Firewall rules should allow communication on necessary ports (e.g., 80, 443, 135, 49152-65535 for DCOM).
8. Time Synchronization: Accurate time synchronization between the NDES server, CA, and domain controllers is critical for certificate validity and authentication.

Meeting these prerequisites establishes a stable foundation for the NDES connector, minimizing potential issues outside of the certificate configuration.

Step-by-Step Guide: Creating and Configuring a V2 NDES Certificate Template¶

To resolve the 0x80090014 error, you must create a new Version 2 certificate template specifically for the NDES server certificate. This certificate is not the SCEP certificate issued to devices, but the certificate that the NDES server uses to authenticate itself to IIS and the Intune connector.

1. Duplicate an Existing Template¶

1. On your Enterprise CA server, open the Certificate Authority console (certsrv.msc).
2. Navigate to Certificate Templates.
3. Right-click on Web Server and select Duplicate Template. This is an excellent base for the NDES server certificate.
4. In the Properties of New Template dialog, ensure the Compatibility tab shows:
   • Certificate Authority: Windows Server 2008 R2 (or later, like 2012 R2, 2016, 2019). This is crucial for enabling V2 features.
   • Certificate Recipient: Windows 7 / Server 2008 R2 (or later).
     These settings ensure it’s a V2 template.

2. Configure the Template Properties¶

Proceed through the tabs, making the following configurations for your new NDES server certificate template.

General Tab¶

• Template display name: Provide a descriptive name, e.g., NDES Server Authentication or Intune NDES Server Cert.
• Template name: Note this down, it’s used internally.
• Validity period: Set to an appropriate duration, e.g., 1 or 2 years.
• Renewal period: Typically 6 weeks.
• Check Publish certificate in Active Directory (optional but recommended for discoverability).
• Check Do not automatically reenroll if a duplicate certificate exists in Active Directory (typically not applicable for service certificates).

Request Handling Tab¶

• Select Signature and encryption for the purpose.
• Check Allow private key to be exported. This is essential if you plan to move the NDES certificate between servers for high availability or disaster recovery.
• Check Enroll subject without requiring any user input.

Cryptography Tab¶

This is where the V2 template’s critical change for 0x80090014 is made.
* Provider Category: Select Key Storage Provider (KSP). This moves away from legacy CSPs.
* Algorithm name: Select RSA.
* Minimum key size: Set to 2048. Stronger encryption is always recommended.
* Request hash: Select SHA256.
* Ensure Allow the private key to be archived is unchecked unless specifically required by your security policy.

Security Tab¶

Grant the necessary permissions for the NDES server’s computer account and the NDES service account.
* Add the computer account of your NDES server (e.g., NDESServer01$). Grant it Read and Enroll permissions.
* Add the NDES service account (the user account configured for the NDES App Pool and service). Grant it Read and Enroll permissions. If auto-enrollment is desired, also grant Autoenroll.
* Remove Domain Users if it has enroll permission, or restrict it. Enterprise Admins and Domain Admins typically have Full Control by default.

Subject Name Tab¶

• Select Supply in the request. This allows the certificate request to specify the server’s FQDN.
• Ensure DNS name is selected under Include this information in alternative subject name.

Extensions Tab¶

• Verify Application Policies. It should include Server Authentication and potentially Client Authentication. NDES uses the certificate for HTTPS binding (Server Authentication).

3. Publish the New Template¶

1. In the Certificate Authority console, right-click on Certificate Templates.
2. Select New > Certificate Template to Issue.
3. Choose your newly created V2 template (e.g., NDES Server Authentication) from the list and click OK.
4. The template should now appear in the list of issued templates.

4. Request the Certificate on the NDES Server¶

After the template is published, you can request the NDES server certificate.

1. On the NDES server, open the Certificates - Local Computer console (certlm.msc).
2. Navigate to Personal > Certificates.
3. Right-click on Certificates, then select All Tasks > Request New Certificate….
4. Click Next twice to reach the Request Certificates page.
5. Select your newly created V2 NDES server certificate template (e.g., Intune NDES Server Cert).
6. Click on the “More information is required to enroll for this certificate. Click here to configure settings.” link.
7. In the Certificate Properties dialog, under the Subject tab:
   • For Subject name type: choose Common name.
   • Enter the Fully Qualified Domain Name (FQDN) of your NDES server (e.g., ndes.contoso.com).
   • Click Add.
   • Under the Alternative name section, for Type: choose DNS.
   • Enter the FQDN of your NDES server again.
   • Click Add.
8. Click OK, then Enroll, and finally Finish.

The certificate should now be successfully installed in the Local Computer’s Personal certificate store. You can verify its properties to ensure it used a KSP and has the correct FQDN and intended purposes.

Troubleshooting Beyond V2 Certificate Configuration¶

While the V2 certificate template is the primary solution, other factors can still cause issues or mimic similar symptoms. If the error persists, consider these additional troubleshooting steps:

1. Verify Private Key Permissions¶

The error message specifically mentions Giving read access to the accountAccountNameon the private key. Even with a V2 template, incorrect private key permissions can lead to CryptAcquireContext failures.

• To check and modify:
  1. Open certlm.msc on the NDES server.
  2. Locate the NDES server certificate (Personal > Certificates).
  3. Right-click the certificate, select All Tasks > Manage Private Keys….
  4. Ensure the NDES service account (e.g., DOMAIN\NDESServiceAccount) and the IIS_IUSRS local group have Full control or at least Read permissions.
  5. The computer account (NDESServer$) should also have appropriate permissions, typically inherited or managed through the certificate request process.

2. NDES Service Account Permissions¶

Double-check all permissions for the NDES service account:

• Local Policies: Verify Log on as a service right on the NDES server.
• Active Directory: Ensure no policies restrict the account from accessing cryptographic services.
• CA Permissions: Confirm the NDES service account has Request Certificates permission on the CA.

3. IIS Configuration and Application Pool Identity¶

The NDES website runs under IIS. The application pool identity needs to be correctly configured.

• Open IIS Manager.
• Navigate to Application Pools.
• Find the NDES App Pool (it might be named something like DefaultAppPool if not explicitly changed during NDES role installation, but it’s best practice to use a dedicated app pool).
• Right-click, select Advanced Settings….
• Under Process Model, ensure Identity is set to the NDES service account (Custom account) or NetworkService if you’ve configured it that way, though a dedicated service account is better.
• Ensure the identity has access to the NDES server certificate’s private key.

4. Firewall Rules and Network Connectivity¶

Confirm that no firewall (Windows Defender Firewall or network hardware firewalls) is blocking communication.

• NDES Server to CA: Required for certificate enrollment (ports 135, dynamic RPC ports 49152-65535, or specific static RPC ports if configured).
• Intune Connector Server to NDES Server: Required if the connector is on a different machine (HTTPS port 443).
• External Access to NDES (if applicable): If NDES is accessible from the internet (e.g., via reverse proxy for cloud-managed devices), ensure HTTPS (443) is open.

5. Time Synchronization (NTP)¶

Discrepancies in time between the NDES server, CA, and domain controllers can invalidate certificates or cryptographic operations.

• Ensure all relevant servers are synchronizing with a reliable NTP source.
• Verify the system time on all servers is accurate within a few minutes.

6. Event Viewer Logs¶

Beyond SetupMSI.log, review other relevant logs:

• Application Log: Look for events from CertEnroll, NDES, IIS, CertificateServicesClient-CertEnroll.
• System Log: Check for general system errors.
• Custom Views:
  • Applications and Services Logs > Microsoft > Windows > CertificateServicesClient-CertEnroll
  • Applications and Services Logs > Microsoft > Windows > NDES
  • Applications and Services Logs > Microsoft > Windows > IIS-Configuration
    These logs can provide more granular details on what went wrong during certificate request or NDES service startup.

7. ADCS Health Check¶

Ensure your Certificate Authority is healthy and functioning correctly.

• Check the CA’s event logs.
• Verify that certificate templates are correctly loaded and issued.
• Test enrollment for a simple Web Server certificate on another machine if possible.

NDES and SCEP Workflow Diagram¶

Understanding the overall flow can help pinpoint where issues might arise.

mermaid graph TD A[Intune] --> |SCEP Profile| B(Intune Certificate Connector) B --> |HTTPS (443)| C[NDES Server] C --> |LDAP (389, 3268) / Kerberos| D(Active Directory) C --> |DCOM / RPC (135, 49152-65535)| E[Enterprise CA] E --> |Issuing Certificate| C E --> |Publishing CRL/Delta CRL| F(CRL Distribution Point / OCSP) C --> |Certificate Status Request| F C --> |SCEP Response| B B --> |SCEP Certificate| A A --> |Install Certificate| G[Managed Device]

Explanation of the flow:
1. Intune pushes a SCEP profile to managed devices.
2. The Intune Certificate Connector acts as a proxy for SCEP requests between Intune and NDES.
3. The NDES Server receives the SCEP request and verifies it with Active Directory.
4. NDES then communicates with the Enterprise CA to request a certificate on behalf of the device.
5. The Enterprise CA issues the certificate and the NDES server retrieves it.
6. The CA publishes Certificate Revocation Lists (CRLs) or uses an Online Certificate Status Protocol (OCSP) responder.
7. NDES includes the issued certificate in a SCEP response back to the Intune Connector.
8. The Intune Connector forwards the certificate to Intune.
9. Intune then pushes the SCEP certificate to the Managed Device.

Issues at any point in this chain can cause certificate deployment failures. The 0x80090014 error specifically points to the initial certificate that NDES uses to secure its own communication with IIS and the Intune connector.

Conclusion¶

The 0x80090014: CryptAcquireContext failed error during NDES certificate installation can be a frustrating roadblock for administrators setting up Intune for certificate-based authentication. However, by understanding that this error frequently stems from using an outdated Version 1 certificate template, the solution becomes clear and actionable. Migrating to a properly configured Version 2 certificate template, which leverages modern Key Storage Providers (KSPs), is the definitive fix.

Beyond the certificate template itself, a thorough understanding of NDES prerequisites, service account permissions, IIS configuration, and network connectivity is vital for a robust SCEP infrastructure. By methodically addressing each potential point of failure, you can ensure that your NDES connector operates seamlessly, empowering Intune to securely provision certificates to your managed devices. Implementing a secure and efficient certificate enrollment process is a cornerstone of modern device management and data protection strategies.

What challenges have you faced with NDES or Intune certificate deployments? Share your experiences and solutions in the comments below, or let us know if this guide helped you resolve your 0x80090014 error!