> ## Documentation Index
> Fetch the complete documentation index at: https://docs.futurex.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Install Active Directory Certificate Services - NDES

> Instructions to install AD CS with Network Device Enrollment Service (NDES) on a dedicated server.

<Note>
  You must install AD CS - Network Device Enrollment Service (NDES) on a server separate from your Enterprise CA.
</Note>

## Install the NDES

Perform the following steps to install the AD CS NDES:

<Steps>
  <Step>
    Go to **Start** > **Administrative** **Tools** > **Server** **Manager** > **Manage**. Then, select
    **\[ Add roles and features ]**.
  </Step>

  <Step>
    On the **Before You Begin** window, select **\[ Next ]**.
  </Step>

  <Step>
    Choose the installation type: **Role-based** or **feature-based** installation. Select **\[ Next ]**.
  </Step>

  <Step>
    On the **Server** **Selection** page, select the server from the domain (or local machine) on which to install AD CS. Select **\[ Next ]**.
  </Step>

  <Step>
    On the **Server Roles** page, check the box next to **Active Directory Certificate Services**. Select **\[ Next ]** and then select **\[ Add Features ]**.
  </Step>

  <Step>
    On the **Features** page, select the following options and then select **\[ Next ]**.

    * Select **.NET Framework 3.5 Features** and include **HTTP Activation**
    * Select **.NET Framework 4.8 Features** and include **HTTP Activation** under **WCF Services**
  </Step>

  <Step>
    On the **AD CS** page, select **\[ Next ]**.
  </Step>

  <Step>
    On the **Role Services** page, select **Network Device Enrollment Service**. Select
    **\[ Next ]**.
  </Step>

  <Step>
    On the **Web Server Role (IIS)** page, select **\[ Next ]**.
  </Step>

  <Step>
    On the **Role** **Services** page, select the following:

    * Security
      * **Request Filtering**
    * Application development
      * **Net Extensibility 4.8**
      * **ASP.NET 4.8**
    * Management Tools
      * **IIS Management Tools**
      * **IIS 6 Management Compatibility**
        * **IIS 6 Metabase Compatibility**
        * **IIS 6 WMI Compatibility**
  </Step>

  <Step>
    Select **\[ Next ]** and then **\[ Install ]**.
  </Step>

  <Step>
    After the installation completes, select **\[ Close ]**.
  </Step>
</Steps>

## Set the IIS permissions

Before moving on to configuring AD CS NDES, you must first set the permissions for your Service Account and Application Pool account. Perform the following steps:

<Steps>
  <Step>
    On the NDES server, use the Windows search bar and look for **Local Users and Groups**. Open it.
  </Step>

  <Step>
    In the left-side meni, go to **Groups**.
  </Step>

  <Step>
    Locate the **IIS\_ISURS** group and right-click it. Select **\[ Properties ]**.
  </Step>

  <Step>
    Select **\[ Add ]** and add both your **Service** **Account** and your **NDES Application Pool** account.
  </Step>

  <Step>
    Select **\[ Apply ]** and then **\[ OK ]**.
  </Step>
</Steps>

## Set the NDES service account

The Domain Administrator account you plan to use for NDES as the service account must have **Logon as a Service** enabled. To enable it, perform the following steps:

<Steps>
  <Step>
    On the NDES server, use the Windows search bar and look for **Local Security Policy**. Open it.
  </Step>

  <Step>
    Expand **Local Policies** and select **\[ User Rights Assignment ]**.
  </Step>

  <Step>
    Locate and double-click **\[ Log on as a service ]**.
  </Step>

  <Step>
    Select **\[ Add user or Group ]**.
  </Step>

  <Step>
    Add your Domain Administrator account acting as the NDES Service Account. Select **\[ OK ].**
  </Step>
</Steps>

For more information on installing and configuring Active Directory Certificate Services - NDES, refer to the Microsoft documentation:

[**learn.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure**](https://learn.microsoft.com/en-us/mem/intune/protect/certificates-scep-configure)