> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure the Certificate Authority for NDES

> Procedures to configure AD CS for Network Device Enrollment Service (NDES), including user creation, certificate templates, and deployment.

After installing ADCS and deploying an Enterprise CA, you now need to configure it for use with NDES.

<Note>
  You have one domain administrator account acting as a Service Account and must create an NDES user acting as the Application Pool account.
</Note>

## Create the user

Perform the following steps to create the NDES Application Pool user and assign it to IIS\_IUSRS:

<Steps>
  <Step>
    Go to **Start** > **Administrative** **Tools** > **Server** **Manager**, and select **\[ Tools ]**.
  </Step>

  <Step>
    Select **\[ Active Directory Users and Computers ]**.
  </Step>

  <Step>
    Expand your domain name and right-click **Users**.
  </Step>

  <Step>
    Select **New** > **User**.
  </Step>

  <Step>
    Give your NDES user a name and select **\[ Next ]**.
  </Step>

  <Step>
    Specify a password for the NDES user and select **\[ Next ].** Then, select **\[ Finish ]**.
  </Step>

  <Step>
    Right-click the user you just created and select **\[ Add to a group ]**.
  </Step>

  <Step>
    In the **Enter the object names to select box**, type **IIS\_IUSRS** and select **\[ OK ]**.
  </Step>

  <Step>
    Right-click your NDES user and select **\[ Properties ]**.
  </Step>

  <Step>
    Go to the **Member of** tab and verify that the user is added to the **IIS\_IUSRS** group.
  </Step>
</Steps>

## Create the certificate template

Perform the following steps to create the NDES certificate template:

<Steps>
  <Step>
    Go to **Start** > **Administrative** **Tools** > **Server** **Manager**, and select **\[ Tools ]**.
  </Step>

  <Step>
    Select **\[ Certification Authority ]**.
  </Step>

  <Step>
    On the left toolbar, expand your domain and right-click **Certificate** **Templates**. Then, select **\[ Manage ]**.
  </Step>

  <Step>
    Locate the **Web Server** certificate template. Right-click and select **\[ Duplicate Template ]**.
  </Step>

  <Step>
    In **General**, give the certificate template a name. (For example: `NDES Encryption`).
  </Step>

  <Step>
    In **Subject** **Name**, select **Supply in the request**.
  </Step>

  <Step>
    In **Extensions**, select **Application** **Policies** > **Edit** and add both **Client** **Authentication** and **Server** **Authentication**.
  </Step>

  <Step>
    In **Security**, select **\[ Add ]** and perform the following steps:

    1. In the **Enter the object names to select** box, enter the name of your NDES Application Pool user and select **\[ OK ]**.
    2. Give your NDES Application Pool user the **Read** and **Enroll** permissions for the certificate.
    3. Give your NDES Service Account **Full Control**.
  </Step>

  <Step>
    In **Request** **Handling**, set the purpose to **Signature and Encryption**. Select the options **Include symmetric algorithms allowed by the subject** and **Allow private keys to be exported**.
  </Step>

  <Step>
    Select **\[ Apply ]** to save your changes, and then select **\[ OK ]**.
  </Step>
</Steps>

## Deploy the certificate

Perform the following steps to deploy the NDES certificate:

<Steps>
  <Step>
    Go to **Start** > **Administrative** **Tools** > **Server** **Manager** and select **\[ Tools ]**.
  </Step>

  <Step>
    Select **\[ Certification Authority ]**.
  </Step>

  <Step>
    Expand your domain on the left toolbar and right-click **Certificate** **Templates**. Then, select **New** > **Certificate** **Template** **to** **issue**.
  </Step>

  <Step>
    Select your NDES certificate you just created and select **\[ OK ]**.
  </Step>
</Steps>

<Note>
  For more information on installing and configuring Active Directory Certificate Services - NDES, refer to the Microsoft

  [documentation](https://learn.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure).
</Note>