Setup NDES with Intune and SCCM
We are planning to issue certificate to clients over the Internet, thus we need to setup NDES Infrastructure.
Steps to configurate NDES:
- NDES Service Account(Just default regular account is fine) 2.NDES Server Certificate Template
- Server Authentication and Workstation Authentication
- 10 Years Validity
- Subject Name is supplied within the request
- Set the NDES Servers to allow enroll this template
3.NDES Certificate Template(This template is used to issue certificates to the clients.)
- On Request Handling: Include symmetric algorithms allowed by the subject Enroll subject without requiring any user input
- Cryptography: Only select “Microsoft Enhanced Cryptographic Provider v1.0”
- The NDES service account has enroll and read access to this template
- Create an Azure AD Application proxy in portal.azure.com
- Internal URL is the FQDN to your internal NDES server
- Pre Authentication: Passthrough
- Get a certificate for NDES Server using the template created in step 2
- Common Name: internal FQDN
- Subject Alternative Name(DNS): internal FQDN external Azure AD App Proxy FQDN
- Run Powershell script to Install NDES https://github.com/MSEndpointMgr/Intune/blob/master/Certificates/Install-MSIntuneNDESServer.ps1
- Please make sure you have at least Powershell 5.1 Installed;
- There should be only one client authentication certificate in the NDES Server;
- .Net 3.5 is required
This command is working on both win10 and Windows servers, please be advised that the server version must must the ISO source DISM /Online /Enable-Feature /FeatureName:NetFx3 /All /LimitAccess /Source:\server_path\OSD\Win2019\sources\sxs .\NDES.ps1 -CertificateAuthorityConfig “ca.corp.lan\caname” -NDESTemplateName “The_template_name_to_issue_client_cert” -NDESExternalFQDN “xxx.msappproxy.net” -RegistrationAuthorityName “NDESRegistrationAuthority” -RegistrationAuthorityCompany “Company_Name” -RegistrationAuthorityDepartment “Dept_Name” -RegistrationAuthorityCity “City_Name” -Verbose 7.Verify newly created NDES https://intunendes-tenantname.msappproxy.net/certsrv/mscep/mscep.dll You should able to see the page of “Network Device Enrollment Service” If you are under co-management with SCCM and Intune, depends on the workload you setup - clients managed by Configuration Manager or Intune, you need an Intune connector or SCCM Policy Module.
Some References:
Setup NDES https://msendpointmgr.com/2018/06/19/certificate-deployment-for-mobile-devices-using-microsoft-intune-part-1-overview/ https://docs.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure#set-up-ndes https://www.petenetlive.com/KB/Article/0000947 https://ronnydejong.com/2014/12/15/part-1-deploy-certificates-to-mobile-devices-using-microsoft-intune-ndes-overview/ Verify NDES configuration on-premises for SCEP certificates in Intune https://docs.microsoft.com/en-US/troubleshoot/mem/intune/verify-ndes-configuration TROUBLESHOOTING NDES FOR INTUNE https://www.jeffgilb.com/troubleshooting-ndes-for-intune/ https://www.anoopcnair.com/intune-scep-certificate-made-easy-with-joy-4/ https://www.anoopcnair.com/intune-scep-http-errors-ts-made-easy-with-joy-5/ Install Certificate Registration Point with SCCM https://docs.microsoft.com/en-us/mem/configmgr/protect/deploy-use/certificate-infrastructure#step-3----install-the-configuration-manager-policy-module-for-scep-certificates-only TROUBLESHOOTING CMG https://ronnydejong.com/2018/07/20/troubleshooting-cloud-management-gateway-quick-effectively-w-cmg-connector-analyzer/