How to Validate and Secure NDES Certificate Template Permissions?

Identify the Template Used by NDES

• Open Registry Editor (regedit.exe) and navigate to:
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP
• Check the values for EncryptionTemplate, GeneralPurposeTemplate, and SignatureTemplate.
• Note the template name listed under the Data column (e.g., ndestemp).

Open the Certificate Templates Console and Locate the Template

• Open the Certification Authority console (certsrv.msc).
• Right-click Certificate Templates and select Manage.
• Locate the template name identified from the registry, right-click it, and choose Properties.

Validate Security Permissions

• Open the Security tab.
• Review all Group or user names and ensure:
  • Only the NDES service account has Enroll permissions.
  • Broad groups do not have Enroll permissions (e.g., Domain Users, Authenticated Users, or other large groups).
  • Administrative groups have only the minimum required permissions (typically Read).
• Remove or uncheck any unnecessary Enroll / Autoenroll permissions.

Apply the Updated Permissions

• Click Apply, then OK.
• Close the Certificate Templates management window.

Restart IIS to Apply Changes

• Open Command Prompt or PowerShell as Administrator.
• Wait for IIS to restart successfully, then verify that SCEP/NDES is accessible again.

For more information on securing NDES certificate templates, refer to the official Microsoft documentation .

Audit Issued Certificates for the NDES Templates

After confirming that the NDES template is correctly configured and restricted, audit the Certification Authority to ensure certificates are issued only to the NDES service account.

Open the Certification Authority Console

• Launch certsrv.msc on the CA server.
• Expand the Certificate Authority node.
• Select Issued Certificates.

Validate the Requester Account

For each certificate issued using the NDES template:

• Check the Requester Name column.
• Ensure it matches the NDES service account (e.g., DOMAIN\ndes).

If certificates were requested by any users other than the intended NDES account, then the template permissions are overly permissive. Investigate and address immediately.

Revoke Unintended Certificates

If any unissued certificates are found:

• Right-click the certificate entry.
• Choose All Tasks → Revoke Certificate.
• Select a revocation reason (e.g., Unspecified).
• Confirm.

This prevents unauthorized certificates from being used for authentication or enrollment.