better error msg on enroll