Replacing the NDES Service Accounts

There may be times when you need to replace the service account for the NDES service. One scenario is if your organizations gets compromised. After a compromise it is common to change the passwords for service accounts and in some cases to replace the service accounts entirely. Of course, there may be other reasons to replace service accounts as well. Today we will review the steps needed to replace the NDES service account and walkthrough the process.

Steps to Replace NDES service account

• Stop the SCEP Application Pool
• Create new service account
• Remove any custom SPNs from the existing service account
• Add any custom SPNs to the new service account
• Add the account to the IIS_IUSRS group on the NDES server(s)
• Add the account to the certificate template that is being provisioned
• Give the new service account read permissions to the private key of the service certificates
• Replace the service account in the SCEP Application Pool
• Start the SCEP Application Pool
• Remove previous service account from the IIS_IUSRS group
• Remove previous service account from private key permissions
• Remove previous service account from certificate template(s)

Service Account Replacement Walkthrough

Stopping the Application Pool

Step 1: On the NDES Server, in Server Manager select Tools, then Internet Information Services (IIS) Manager

Step 2: Navigate to and select Application Pools

Step 3: Right-click on the SCEP Application Pool and then select Stop from the context menu

Creating the Service Account

Step 1: On your Adminstration Workstation open Active Directory Users and Computers

Step 2: Right-click on the OU that contains your service accounts

Step 3: From the context menu select New then User

Step 4: Fill out the Full name and User logon name the click Next

Step 5: Enter and confirm the password and select Password never expires if appropriate, then click Next

Step 6: Click Finish

Managing the SPNs (if applicable)

Step 1: Open an elevated command prompt on your Administration Workstation (as a Domain or Enterprise Admin)

Step 2: Run the following command: setspn -l <NDES Service Account Name>

Step 3: Not any custom SPNs (in my example it is http/ndes.fourthcoffee.com)

Step 4: To remove the SPN run the following command: setspn -D <SPN> <NDES Service Account Name>

Step 5: Add the SPN to the new service account by running the following command: setspn -S <SPN> <New NDES Service Account Name>

Adding the Service Account to the IIS_IUSRS group

Step 1: In Server Manager select Tools then Computer Management

Step 2: Navigate to Local Users and Groups, then Groups

Step 3: Open the IIS_IUSRS group

Step 4: Click Add…

Step 5: Enter the new service account and click OK

Step 6: Click OK

Managing Service Certificates Private Keys

Step 1: As a user that is local administrator on the NDES server open certlm.msc

Step 2: Navigate to Personal and then Certificates

Step 3: Locate the CEP Encryption certificate

Step 4: Right-click on the certificate and click All Tasks then Manage Private Keys…

Step 5: Click Add…

Step 6: Enter the service account and click OK

Step 7: Provision the new service account with just Read permissions

Step 8: Click OK

Step 9: Locate the Exhange Enrollment (Offline Request) certificate

Step 10: Right-click on the certificate and click All Tasks then Manage Private Keys…

Step 11: Click Add…

Step 12: Enter the service account and click OK

Step 13: Provision the new service account with just Read permissions

Step 14: Click OK

Give the New Service Account Enroll Permissions on the Certificate Template

Determine the certificate template(s) you are distributing with NDES

Step 1: On the CA logon as an Enterprise Admin

Step 2: Open the Certification Authority MMC

Step 3: Right-click on Certificate Templates and then select Manage from the context menu

Step 4: Navigate to the certificate template you are distributing with NDES

Step 5: Right-click on the certificate template and select Properties from the context menu

Step 6: On the certificate template click Add…

Step 7: Enter the new service account name and click OK

Step 8: Give the account Enroll permissions

Changing the Service Accounts in the SCEP Application Pool

Step 1: Open Internet Information Services (IIS) Manager on the NDES server as a member of the local administrators group

Step 2: Navigate to Application Pools

Step 3: Right-click on the SCEP application pool and select Advanced Settings…

Step 4: In Advanced Settings click on the … after the current service account (Identity)

Step 5: Click Set…

Step 6: Enter the service account in domain\user format and then enter and confirm the account password

Step 7: Click OK

Step 8: Click OK

Step 9: Click OK

Step 10: Return to the SCEP application pool

Step 11: Right-click on the SCEP application pool and select Start from the context menu

De-provisioning steps

The following steps need to be completed to deprovision the previous service account. However, these steps will not be covered by this walkthrough as those steps should be obvious after completing the above walkthrough.

• Remove previous service account from the IIS_IUSRS group
• Remove previous service account from private key permissions
• Remove previous service account from certificate template(s)

-Chris

I wanted to draw some attention to an NDES test tool that I have been using for a while. My thanks to the author (Hasain Alshakarti) of the toolbox and steps as it is one of the few ways that I am aware of to test NDES without access to actual hardware or an MDM solution. I am going to cover the steps to use the tool. I understand that the instructions on the authors website are pretty straight forward and pretty easy to follow. However, I think the screenshots may give you all an idea of what to expect when using the tool.

The tool and instructions for the tool are available here: http://secadmins.com/index.php/ndes-scep-windows-test-tool/.

Once you have downloaded an extract the tool and perform the following steps:

Step 1: Access the mscep_admin site on your web server as a Device Admin. In my example this is http://fcndes01.fourthcoffee.com/certsrv/mscep_admin. Note: My certsrv directory is not protected with TLS. As a best practice it should be protected with TLS.

Step 2: Copy the enrollment challenge password for later use. In my example the password is BA86D09D04DAC557

Step 3: Open a command prompt and navigate to the directory where the tools were extracted

Step 4: Run openssl.exe req -config scep.cnf -new -key priv.key -out test.csr, to generate the reques

Step 5: Enter the Common Name (subject) for the certificate and click Enter

Step 6: Paste or manually enter the enrollment challenge password, then click Enter. In my example it is: BA86D09D04DAC557

Step 7: To retrieve the CA certificate (which is part of the NDES enrollment process), run the following command: sscep.exe getca -u http://<your NDES server DNS Name or IP address here>/certsrv/mscep/ -c ca.crt

The output you receive will look something like this:

Step 8: Run the following command to enroll for the certificate: sscep.exe enroll -u http://<your NDES server DNS Name or IP address here>/certsrv/mscep/> -k priv.key -r test.csr -l test.crt -c ca.crt-0 -e ca.crt-1

Step 9: Verify the pkistatus is Success

You can also open test.crt to verify the result:

In addition you can view the request in the IIS logs of the NDES server:

Thanks to Hasain Alshakarti for putting the toolbox and process to test NDES enrollment.

-Chris

The following steps are the steps to reset the NDES service account password. This is pretty simple and straight forward.

Step 1: As a Domain Administrator or a user that has been delegated the ability to reset passwords open up Active Directory Users and Computers (dsa.msc)

Step 2: Locate the service account

Step 3: Right-click on the account and select Reset Password…

Step 4: Enter and confirm a password and click OK

Step 5: Click OK to acknowledge the prompt

Step 6: On the NDES server open Server Manager

Step 7: From the Tools menu select Internet Information (IIS) Manager

Step 8: Navigate to Application Pools

Step 9: Right-click on the SCEP application pool and select Stop

Step 10: Right-click on the SCEP application pool and select Advanced Settings…

Step 11: Click the 3 dots … after the service account under Identity

Step 12: In the Application Pool Identity window click the Set… button

Step 13: Enter the service account name in domain\user format

Step 14: Enter and confirm the password

Step 15: Click OK

Step 16: Click OK

Step 17: On Advanced Settings click OK

Step 18: Right-click on the SCEP application pool and select Start

That’s it. I’m going to continue writing NDES articles until I exhaust the topics that come to mind. At some point I will move on to configuration and known issues with the Web Enrollment Proxy.

-Chris

Hello, this blog covers the process I developed to renew the NDES Service Certificates. I thought I had also created a blog with steps to enable these to autoenroll, but I can’t find it at the moment. Basically, NDES uses a CEP Encryption certificate and Exchange Enrollment Agent certificate. Unless things have changed recently there is no obvious ways to renew them hence this article. If you have a better solution feel free to let me know. Another option is to simply uninstall and then re-install NDES using the same service account.

In an upcoming article I will cover how change the service account passwords and how to replace the NDES service account in case of a compromise or security concerns around the service account.

Step 1: First give the NDES Server Read and Enroll permission to the CEP Encryption Certificate Template.

Step 2: Open the certificates MMC targeted to the computer.  Expand Personal.  Right-click on Certificates.  From the context menu select All Tasks then Renew Certificate with New Key…

Step 3: On the Before You Begin page of the wizard, click Next.

Step 4: On the Request Certificates page, click Enroll.

Step 5: On the final page of the wizard, click Finish.

Step 6: Open Certmgr.msc as a user that has Read and Enroll permissions to the Exchange Enrollment Certificate Template.  Expand Personal, right click on Certificates.  Select All Tasks, and then Request New Certificate…

Step 7: On the Before You Begin page, click Next.

Step 8: On the Select Certificate Enrollment Policy page, click Next.

Step 9: Select the Exchange Enrollment Agent certificate template, and click the More information is required to enroll for this certificate. Click here to configure settings. link.

You will want to user the same Subject Name that is in your current Exchange Enrollment certificate. The following steps illustrate the steps needed to do this. You can find the current subject name by opening the Certificates MMC targeted to the local machine and then open the existing Exchange Enrollment Agent certificate. In my example the name was CN=FCNDES01-MSCEP-RA,C=US.

Step 10: Under Subject Name ensure that Common Name is selected and under Value enter the common name that is in your existing certificate. Then click Add.

Step 11: Change the Type to Country and under Type the country code that is your existing Exchange Enrollment Agent certificate.

Step 12: Click Add

Step 13: On the Private Key tab, select Make private key exportable.  Then click OK.

Step 14: Then click Enroll.

Step 15: Right-click on the Exchange Enrollment certificate in the users personal store.  Select Export…

Step 16: When the Certificate Export Wizard opens, click Next.

Step 17: On the Export Private Key page, select Yes, export the private key.

Step 18: On the Export File Format page, select Personal Information Exchange – PKCS #12 (.PFX)

Step 19: On the Password page, enter a password and click Next.

Step 20: On the File to Export page, click the Browse… button.  Select the file name and save location.  When finished click Next.

Step 21: n the final page of the wizard, click Finish.

Step 22: Then click OK.

Step 23: In the Certificate MMC on the NDES Server that is targeted to the computer, expand Personal.  Right-click on Certificates.  From the context menu, select All Tasks and then Import…

Step 24: On the Welcome page, click Next.

Step 25: Browse to the PFX file you previously created, and click Next.

Step 26: On the Password page, enter the password associated with the PFX file.

Step 27: On the Certificate Store page, click Next.

Step 28: On the final page of the wizard, click Finish.

Step 29: Then click OK.

Step 30: In the Certificate MMC on the NDES Server that is targeted to the computer, expand Personal.  Right-click on the old Exchange Enrollment certificate, and select Delete. 

Step 31: Then click Yes, to accept the deletion.

Step 32: Right click on the new Exchange Enrollment certificate.  From the context menu, select All Tasks then Manage Private Keys…

Step 33: Add the NDES service account and ensure that it just has Read permission.  Click OK.

Step 34: Right click on the new CEP Encryption certificate.  From the context menu, select All Tasks then Manage Private Keys…

Step 35: Add the NDES service account and ensure that it just has Read permission.  Click OK.

Step 36:  Reset IIS using iisreset command.

Feel free to contact me with any topics you would like me to cover with a future blog posting or YouTube video.

-Chris