NDES PKI Server Migration from Windows 2016 to Windows 2022

G Vedavyas 0 Reputation points
2026-10-26T13:26:25.2833333+00:00

Hi team,

As windows 2016 server is getting deprecated, we are in process of migrating the NDES server from 2016 to 2022. Please let me know what are the best practices to follow and if you have any guides, please feel free to share. Looking forward for your response.

Thanks,

Ved

Windows for business | Windows Server | Directory services | Certificates and public key infrastructure (PKI)
0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. VPHAN 47,355 Reputation points Independent Advisor
    2026-10-26T14:04:05.0166667+00:00

    Hi G Vedavyas

    A side-by-side migration is the recommended approach for moving your Network Device Enrollment Service to Windows Server 2022.

    Begin by identifying the service account running your IIS SCEP application pool and documenting your IIS HTTPS bindings. You must also check the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP registry path on your current server. Record the string values for SignatureTemplate, EncryptionTemplate, and GeneralPurposeTemplate. These keys are critical because they dictate the exact certificate templates your NDES server is permitted to request from your Certification Authority.

    Deploy a fresh Windows Server 2022 instance, install the Active Directory Certificate Services role, and select only the NDES feature. Configure it using your existing service account and point it to your current Certification Authority. Allow the new system to generate its own Registration Authority certificates automatically during installation instead of attempting to migrate the old private keys. Next, recreate the three MSCEP registry keys on the new server, add your service account to the local IIS_IUSRS group, and ensure this account retains read and enroll permissions on the target templates. If your environment relies on a custom DNS alias or load balancer, register the appropriate HTTP Service Principal Names against the service account via the command line to ensure Kerberos authentication functions seamlessly.

    Validate the setup by browsing locally to the mscep.dll administration page on the new server to confirm the portal loads. Reinstall any endpoint management software, like the Intune Certificate Connector, directly onto the new machine and execute a test device enrollment. Once a device successfully receives and trusts a certificate, update your DNS records or load balancer to route production traffic to the new server. Keep the 2016 machine offline but intact for a few weeks to monitor automated certificate renewals before safely decommissioning it.

    Hope this answer has brought you some useful information. If it did, please hit “accept answer”. Should you have any questions, feel free to leave a comment.

    VPHAN

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-26T13:27:59.8333333+00:00

    Deploy a new Windows Server 2022 NDES server side by side, reproduce the NDES and deployment-specific integration configuration, validate SCEP enrollment, and then switch the production SCEP endpoint rather than treating NDES as a Certification Authority database migration.

    Microsoft’s role-migration matrix supports AD CS migration but does not list a dedicated migration guide for the NDES role service, so a clean NDES installation provides the safest rollback path.^1^

    Also, Windows Server 2016 is in Extended Support—not yet unsupported—and reaches end of support on January 12, 2027.^2^

    1. Inventory the existing NDES deployment

    Using local administrator access on the 2016 server, record:

    • NDES service account and the identity of the IIS SCEP application pool.
    • Issuing CA name and connectivity requirements.
    • Values under: HKLM\SOFTWARE\Microsoft\Cryptography\MSCEP
      • SignatureTemplate
      • EncryptionTemplate
      • GeneralPurposeTemplate
    • IIS HTTPS binding, production SCEP hostname, TLS certificate, authentication settings, request-filtering limits, and firewall rules.
    • URLs currently supplied to devices or MDM:
      • https://<hostname>/certsrv/mscep
      • https://<hostname>/certsrv/mscep_admin
    • Any Intune Certificate Connector, Configuration Manager policy module, Web Application Proxy, Entra Application Proxy, or third-party MDM component. These components must be installed and configured using their product-specific procedure; copying only IIS and registry settings is insufficient.

    NDES uses IIS and the SCEP application pool to submit requests to the CA and return issued certificates.^3^

    2. Build and configure Windows Server 2022

    1. Fully patch the destination server before migration, as recommended for both source and destination systems.^1^
    2. Join it to the appropriate domain and configure DNS, firewall, and CA connectivity.
    3. In Server Manager → Manage → Add Roles and Features:
      • Select Active Directory Certificate Services.
      • Select Network Device Enrollment Service, not Certification Authority, unless this server intentionally hosts the CA.
      • Install the required IIS and HTTP Activation dependencies.
    4. Open Server Manager → AD CS Configuration and configure:
      • Role Services: Network Device Enrollment Service
      • Service Account for NDES
      • CA for NDES: existing issuing CA
      • Cryptography for NDES: settings meeting organizational requirements
      • Confirmation → Configure^4^

    Use temporary Enterprise Administrator or equivalent access for AD CS post-deployment configuration where required, then remove that elevated access. Use local administrator access for IIS and local registry configuration.

    The installation creates new NDES Registration Authority keys and certificates. Validate the new RA certificates; do not copy the old server’s RA private keys. Reinstalling NDES causes RA certificates to be reissued.^5^

    3. Configure permissions and templates

    For a domain NDES service account:

    • Add it to the new server’s local IIS_IUSRS group.
    • On the CA, ensure it has Request Certificates permission. This requires Manage CA permission to change.
    • Ensure it has Read and Enroll on the NDES certificate templates.
    • Populate the three MSCEP registry mappings using the template name, not display name.^6^

    After changing template mappings, restart the server, not only IIS.^4^

    Install and bind an IIS server-authentication certificate that covers the production SCEP hostname—normally in the Subject Alternative Name, with the documented CN matching the NDES FQDN—and whose chain is trusted by enrolling devices.

    4. Conditional: virtual name, CNAME, or load balancer

    If clients use a CNAME, custom A record, virtual IP, or load-balanced name, register HTTP SPNs against the NDES service account:

    setspn -s HTTP/ndes.example.com CONTOSO\NdesService
setspn -s HTTP/NDES CONTOSO\NdesService
setspn -Q HTTP/ndes.example.com
setspn -Q HTTP/NDES

    Replace the names and account with your values, verify there are no duplicate registrations, and disable IIS kernel-mode authentication for the applicable site as required for this configuration.^6^

    5. Validate before cutover

    1. Browse internally to the new certsrv/mscep/mscep.dll endpoint and confirm the NDES page loads.
    2. Confirm the SCEP application pool remains started.
    3. Verify the IIS certificate chain and production hostname.
    4. Submit a test SCEP enrollment and verify:
      • Request reaches the issuing CA.
      • CA issues the expected template.
      • Device retrieves and trusts the certificate.
    5. For Intune deployments, install/configure the Intune Certificate Connector on the new server, then run Microsoft’s Validate-NDESConfiguration.ps1 with the service account, issuing CA FQDN, and SCEP template.^7^
    6. Switch DNS, proxy, load balancer, or MDM SCEP configuration to the new server. Keep the old server stopped but recoverable until successful renewals and new enrollments are confirmed.

    If the Certification Authority itself is also hosted on the 2016 server, that is a separate CA migration requiring backup and restoration of the CA database, private key, configuration, and publication paths; do not apply the NDES-only procedure to the CA.^8^

    References

    1. Upgrade and migrate roles and features in Windows Server
    2. Ending Support in 2027
    3. What is Network Device Enrollment Service for Active Directory Certificate Services?
    4. Configure infrastructure to support SCEP with Intune
    5. SCEP deployment to Windows 10 devices fails after you renew the CA certificate
    6. Configure Network Device Enrollment Service to use a domain user account
    7. Verify on-premises NDES configuration for SCEP certificates in Intune
    8. Migrate a Certification Authority
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.