# Integrating Microsoft AD CS server with MDM

Microsoft  Active Directory Certificate Services (AD CS) provides digital certificates that can be used to encrypt, digitally sign and authenticate users and devices on a network. By integrating Microsoft AD CS with Mobile Device Manager Plus, IT admins can leverage AD and Groups Policy for certificate registration and assignments. It allows organizations to dynamically create user-specific certificates, distribute certificates at large scale and automatically renew the certificates on devices, thereby ensuring data security and compliance to organizational standards.

## Pre-requisites

[NDES must be installed in a Windows Server machine](https://learn.microsoft.com/en-us/windows-server/identity/ad-cs/network-device-enrollment-service-overview)

### Configure Certificate Template

1. Open the Start Menu, select **Run**, type **mmc**, and click **OK**.
2. Go to **File > Add/Remove Snap-in**, select **Certificate Templates**, click **Add**, and then click **OK**.

![Configure SCEP for iOS Step 1](https://www.manageengine.com/mobile-device-management/help/images/scep_1.jpg)
![Configure SCEP for iOS Step 2](https://www.manageengine.com/mobile-device-management/help/images/scep_2.jpg)

3. Right click **Certificate Template** and select **Manage**.
4. Right Click on **the required template** and select **Duplicate Template**.
5. Specify a **Template display name** and save it by clicking **OK** to save the new template.

![Configure SCEP for iOS Step 4](https://www.manageengine.com/mobile-device-management/help/images/scep_4.jpg)

6. Navigate to **Extensions > Application Policies**, click **Edit**, and add **Client Authentication** to the list of policies.

![Configure SCEP for iOS Step 5](https://www.manageengine.com/mobile-device-management/help/images/scep_6.jpg)
![Configure SCEP for iOS Step 6](https://www.manageengine.com/mobile-device-management/help/images/scep_7.jpg)
![Configure SCEP for iOS Step 7](https://www.manageengine.com/mobile-device-management/help/images/scep_8.jpg)
![Configure SCEP for iOS Step 8](https://www.manageengine.com/mobile-device-management/help/images/scep_5.jpg)

**Note:** Add or remove only the required **Application Policies** values.

7. Select **Cryptography** and configure the **Minimum Key Size**. A key size of **2048 bits** is recommended for enhanced security. This value must match the configuration used when setting up **SCEP** in MDM.

![Configure SCEP for iOS Step 9](https://www.manageengine.com/mobile-device-management/help/images/scep_9.jpg)

8. Create a **dedicated Active Directory (AD) user account** for the NDES service. This NDES Service account will be used by ADCS to proxy certificate requests from MDM-enrolled devices.
9. Go to the Security tab of the certificate template > Add the NDES service account > Grant Read and Enroll permissions.  
   **Important Note:** Avoid granting Enroll permissions to broad or widely scoped groups, such as Domain Users. This can lead to unintended enrollments, unauthorized certificate requests and potential impersonation risks.

Make sure to take a look at your existing certificate templates and review if the permissions are setup properly by following the recommended steps in our [how-to document](https://www.manageengine.com/mobile-device-management/how-to/secure-ndes-certificate-template-permissions.html). Read more on technical controls for securing PKI on the [Windows official documentation](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786426(v=ws.11)#securing-certificate-templates).

![Configure SCEP for iOS Step 10](https://www.manageengine.com/mobile-device-management/help/images/scep_10.jpg)

10. Click on **Subject Name** and select **Supply in the request**, for subject names to be specified in the certificate request.

![Configure SCEP for iOS Step 11](https://www.manageengine.com/mobile-device-management/help/images/scep_11.jpg)

### Map Certificate Template to SCEP

1. Add Certificate Authority as a snap-in in the Microsoft Management Console (MMC).

![Configure SCEP for iOS Step 12](https://www.manageengine.com/mobile-device-management/help/images/scep_12.jpg)
![Configure SCEP for iOS Step 13](https://www.manageengine.com/mobile-device-management/help/images/scep_13.jpg)

2. Expand **Certification Authority** and right-click on **Certificate Templates**. Click **New** and select **Certificate Template to Issue**.

![Configure SCEP for iOS Step 14](https://www.manageengine.com/mobile-device-management/help/images/scep_14.jpg)

3. Select the Certificate Template created before and click OK.

![Configure SCEP for iOS Step 15](https://www.manageengine.com/mobile-device-management/help/images/scep_15.jpg)
![Configure SCEP for iOS Step 16](https://www.manageengine.com/mobile-device-management/help/images/scep_16.jpg)

To change the default certificate template used by Microsoft NDES, Windows registry values are to be changed.

4. Click on **Start** Menu, select **Run**, type **regedit** and click OK.
5. Expand `HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft -> Cryptography -> MSCEP`.
6. Right-click on **Encryption Template** and click **Modify**.

![Configure SCEP for iOS Step 17](https://www.manageengine.com/mobile-device-management/help/images/scep_17.jpg)

7. Specify the name of the created Certificate Template for **Value data**. Repeat the same for **GeneralPurposeTemplate** and **SignatureTemplate**. Restart the server machine once for the changes to take place.

![Configure SCEP for iOS Step 18](https://www.manageengine.com/mobile-device-management/help/images/scep_18.jpg)

### Prevent challenge password expiry

1. Open regedit and expand `HKEY_LOCAL_MACHINE -> SOFTWARE -> Microsoft -> Cryptography -> MSCEP -> UseSinglePassword`.
2. Right-click **UseSinglePassword** and change the value of **data** as 1.

![Configure SCEP for iOS Step 19](https://www.manageengine.com/mobile-device-management/help/images/scep_19.jpg)

If you're using Challenge password (recommended), then registry values must be modified to prevent expiry of Challenge password.

**After configuration is complete, restart the NDES Server.**

### Steps to increase the password cache limit

1. Open the Registry Editor in NDES machine and navigate to `HKEY_LOCAL_MACHINE - > SOFTWARE -> Microsoft -> Cryptography -> MSCEP -> UseSinglePassword`.

![](https://www.manageengine.com/mobile-device-management/help/images/scep_pwd1.PNG)

2. Set the value for **UseSinglePassword** to **0**. By configuring this, every time we hit the NDES admin URL, it will generate a unique challenge password.  
   Admin URL: **https://<ndes_fqdn>/certsrv/mscep_admin/mscep.dll**
3. Restart the IIS server.

![](https://www.manageengine.com/mobile-device-management/help/images/scep_pwd2.PNG)

4. As shown in the above screenshot, when we navigate to the Admin URL, we will get a challenge password, and upon refreshing the page, we will get another challenge password.
5. A problem with this configuration is that NDES will only generate 5 passwords each hour.

![](https://www.manageengine.com/mobile-device-management/help/images/scep_pwd3.PNG)

6. We can resolve this by increasing the Password cache limit of the NDES. To do this, in the registry editor, navigate to `HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\MSCEP`.
7. Create a new key and provide the name as **PasswordMax**.
8. Right click on the **PasswordMax** key, and select **New -> DWORD (32-bit) Value**, provide the name as **PasswordMax** and provide a value according to your organization needs.

![](https://www.manageengine.com/mobile-device-management/help/images/scep_pwd4.PNG)

9. Restart the IIS.

### Configuring SCEP in MDM

1. The value for Subject should be in LDAP DN format as explained [here](https://msdn.microsoft.com/en-us/library/aa366101(v=vs.85).aspx).

Follow the steps given below to configure SCEP in MDM:

- On the console, navigate to **Device Mgmt -> Certificates**
- Click on the **CA Servers** tab and click on **Add CA server**
- Provide the following details:

| Profile Specification | Description |
|---|---|
| Server Type | Specify server type as Microsoft AD CS. |
| Certificate Authority Name | Specify the name of the Certificate Authority issuing certificates. |
| Server URL | The URL to be specified in the device to obtain certificate. Provide HTTP Server URL, if the SCEP server is within the organization network and not exposed to external networks. The certificate is requested through this URL. |
| Add CA Certificate | Upload the Certificate Authority's certificate |

## Creating templates for the CA servers

For creating user-specific certificates, a template needs to be configured based on which all the certificates will be issued by the CA.

Follow the steps given below to configure the template on MDM:

- On the console, navigate to **Device Mgmt -> Certificates**.
- Click on **Templates** tab and click on **Add Templates**
- Select the server to which the template belongs
- Provide the following details:

| Profile Specification | Description |
|---|---|
| Certificate Template Name | Specify the certificate template name. |
| Subject | Specify the Subject DN that needs to be present in the certificate. You can use dynamic keys such as %username%, %email%, %firstname% to fetch the corresponding details mapped to the device. For instance, you can specify C=US,O=Zylker,OU=Zylker,CN=%firstname%. |
| Subject Alternative Name Type | Specify one of the following values None, RFC 822 Name, DNS Name or Uniform Resource Identifier for the subject alternative name type |
| Subject Alternative Name Value (Can be configured only if Subject Alternative Name Type is configured) | Specify a value for subject alternative name value. The values to be entered can include DNS name, URI or email. For instance, you can use the dynamic key **%email%** for the subject alternative name value, email. |
| NT Principal Name | Specify the NT Principal Name used in the organization. |
| Maximum Number of Failed Attempts | Maximum number of failed validation attempts allowed to obtain the certificate from the CA. Once the maximum limit is exceeded, users will be temporarily restricted from attempting to validate the user account. |
| Time interval between attempts | Time to wait before subsequent attempts to obtain the certificate |
| Challenge Type | A pre-shared secret key provided by the CA, which adds additional layer of security. If **Static** is chosen, the challenge password will be submitted to the SCEP server for authentication and all the devices will use the same password for authentication. If **Dynamic** is chosen, each device will use a unique challenge password for authentication. If **None** is chosen, no authentication is requested by the SCEP server and any device can receive the certificate by accessing the SCEP URL. |
| Enrollment Challenge Password (Can be configured only if Static challenge type is selected) | Provide the challenge password to be used for authentication. |
| Challenge URL (Configurable only if challenge type is set as Dynamic) | Specify the AD CS MSCEP admin endpoint URL. |
| Challenge Username (Configurable only if challenge type is set as Dynamic) | Specify the AD CS MSCEP admin username to be used. |
| Challenge Password (Configurable only if challenge type is set as Dynamic) | Specify the AD CS MSCEP admin password to be used. |
| Key Size | Specify whether the key is 1024 or 2048 bits |
| Use as Digital Signature | Enabling this option ensures the certificate can be used for Digital Signature |
| Use for Key Encipherment | Enabling this option ensures the certificate can be used for Key Encipherment |
| Certificate Auto Renewal | Enabling this option ensures the certificates are renewed automatically before it expires. |
| Certificate Automatic Renewal Before | Specify the number of days before which the certificate must be auto-renewed. |

## Creating a SCEP profile

To distribute certificates to managed devices, a SCEP profile need to associated with these devices. Follow the steps given below to create and associate the SCEP profile to devices:

1. Navigate to **Device Mgmt -> Profiles** and create either an Apple, Android or Windows profile.
2. Select **SCEP** from the left pane.
3. Select the created Certificate template.
4. Save and publish the profile.

It is recommended to distribute the [profile to a device](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_devices.html) for testing before distributing it to your production environment. Once testing is complete, you can distribute the profile to your production environment using [Groups](https://www.manageengine.com/mobile-device-management/help/profile_management/mdm_associating_profiles_to_groups.html).