# How to Validate and Secure NDES Certificate Template Permissions?

Last updated: July 24, 2026

This guide helps administrators validate and secure the NDES certificate template used for issuing SCEP certificates to mobile devices. It covers identifying the template via the Windows registry, reviewing its Security tab to ensure only the NDES service account has Enroll permissions, restarting IIS to apply changes, auditing issued certificates to confirm they were requested only by the NDES account, revoking any unauthorized certificates, and confirming the AD CS template review in the MDM console.

## Overview

When integrating ADCS certificate templates into MDM to deploy user certificates to mobile devices, it is important to review the PKI deployment and certificate template permissions to ensure that certificates are issued only for authorized purposes and through authorized sources. The following steps will help validate that your existing ADCS certificate templates are securely configured.

## Identify the Template Used by NDES

- Open **Registry Editor** (`regedit.exe`) and navigate to:
  `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP`
- Check the values for **EncryptionTemplate**, **GeneralPurposeTemplate**, and **SignatureTemplate**.
- Note the template name listed under the **Data** column (e.g., *ndestemp*).

![Configure SCEP for iOS Step 18](https://cdn.manageengine.com/mobile-device-management/images/ndes1.png)

## Open the Certificate Templates Console and Locate the Template

- Open the **Certification Authority** console (`certsrv.msc`).
- Right-click **Certificate Templates** and select **Manage**.
- Locate the template name identified from the registry, right-click it, and choose **Properties**.

![Configure SCEP for iOS Step 18](https://cdn.manageengine.com/mobile-device-management/images/ndes2.png)

## Validate Security Permissions

- Open the **Security** tab.
- Review all **Group or user names** and ensure:
  - Only the **NDES service account** has **Enroll** permissions.
  - Broad groups do **not** have Enroll permissions (e.g., Domain Users, Authenticated Users, or other large groups).
  - Administrative groups have only the minimum required permissions (typically **Read**).
- Remove or uncheck any unnecessary **Enroll** / **Autoenroll** permissions.

![Configure SCEP for iOS Step 18](https://cdn.manageengine.com/mobile-device-management/images/ndes3.png)

## Apply the Updated Permissions

- Click **Apply**, then **OK**.
- Close the Certificate Templates management window.

## Restart IIS to Apply Changes

- Open **Command Prompt** or **PowerShell** as Administrator.
- Wait for IIS to restart successfully, then verify that **SCEP/NDES** is accessible again.

***For more information on securing NDES certificate templates, refer to the official [Microsoft documentation](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn786426(v=ws.11)#securing-certificate-templates).***

## Audit Issued Certificates for the NDES Templates

After confirming that the NDES template is correctly configured and restricted, audit the Certification Authority to ensure certificates are issued **only** to the NDES service account.

### Open the Certification Authority Console

- Launch **certsrv.msc** on the CA server.
- Expand the **Certificate Authority** node.
- Select **Issued Certificates**.

![Configure SCEP for iOS Step 18](https://cdn.manageengine.com/mobile-device-management/images/ndes4.png)

### Validate the Requester Account

For each certificate issued using the NDES template:

- Check the **Requester Name** column.
- Ensure it matches the NDES service account (e.g., **DOMAIN\ndes**).

![Configure SCEP for iOS Step 18](https://cdn.manageengine.com/mobile-device-management/images/ndes5.png)

If certificates were requested by any users other than the intended NDES account, then the template permissions are overly permissive. Investigate and address immediately.

### Revoke Unintended Certificates

If any unissued certificates are found:

- Right-click the certificate entry.
- Choose **All Tasks → Revoke Certificate**.
- Select a revocation reason (e.g., **Unspecified**).
- Confirm.

![Configure SCEP for iOS Step 18](https://cdn.manageengine.com/mobile-device-management/images/ndes6.png)

*This prevents unauthorized certificates from being used for authentication or enrollment.*

## Review AD CS Template Configuration

Review the AD CS certificate template permissions configured for the SCEP protocol to ensure they align with the recommended security settings. Once the review is complete, proceed to the CA server configuration to confirm the review.

### Steps to Confirm the AD CS Certificate Permission Configuration

1. In the MDM console, navigate to **Device Mgmt > Certificates > CA Servers**. Locate the configured **Microsoft ADCS** server, click the **More actions (⋯)** icon, and select **Modify**.

![How to Validate and Secure NDES Certificate Template Permissions? illustration 9](https://cdn.manageengine.com/mobile-device-management/images/consent1.png)

On the **Modify** page, the **AD CS Validation Consent** checkbox is displayed for confirming the review.

![How to Validate and Secure NDES Certificate Template Permissions? illustration 10](https://cdn.manageengine.com/mobile-device-management/images/consent2.png)

Select the **AD CS Validation Consent** checkbox to confirm that the AD CS template review has been completed, and then click **Save**.

## Frequently Asked Questions

### How do I find out which certificate template NDES is using?

Open Registry Editor (`regedit.exe`) and check `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP` for the EncryptionTemplate, GeneralPurposeTemplate, and SignatureTemplate values - the Data column shows the template name (e.g., ndestemp).

### How do I make sure only the NDES service account can enroll using this template?

Open the template's Properties in the Certificate Templates console, review the Security tab, and ensure only the NDES service account has Enroll permissions - remove Enroll/Autoenroll access from broad groups like Domain Users or Authenticated Users, then restart IIS to apply the change.

### How do I confirm no unauthorized certificates were issued from this template?

In the Certification Authority console, check Issued Certificates and verify the Requester Name matches the NDES service account for every certificate issued from the template; revoke any certificate requested by anyone else and choose a revocation reason.