1. Check if certificate for ndes is not expired. Certificate is on the certificate list so they should be renewed before they expire.
2. check if the service account. If you try to unlock account and get a "the administrative limit for this request was exceeded" error message do the following.
a. log into Kailua
b. open windows powershell as administrator
c. $certUser = Get-Aduser "svc-ndes-intune" -Properties certificates
d. $certuser.Certificates.Count this should show a low number. if not continue.
e. set-ADUser svc-ndes-intune -Certificates @{}
f. $certUser = Get-Aduser "svc-ndes-intune" -Properties certificates
g. $certuser.Certificates.Count should show as zero now.
h. on azkms start all the pfx services. They should start now.