PKI Password Cache monitoring?

Hello there,

I am curious if monitoring can be done for this and how it would be done. Is it possible to monitor the password cache space for a PKI server? In particular, password cache for cert enrollment on Network Device Enrollment Service. By default, cert enrollment attempts are put in the cache for an hour if it is deemed incomplete and 5 attempts are allowed to be cached. You can raise this default with the PasswordMax reg key.

I figured it would be helpful to monitor this to know what the key value would need to be set to or to be proactive with solving/troubleshooting issues where the cache becomes full. Perhaps a powershell script would suffice? Thanks in advance for any tips! 😄

https://social.technet.microsoft.com/wiki/contents/articles/9063.active-directory-certificate-services-ad-cs-network-device-enrollment-service-ndes.aspx#Password_and_Password_Cache