From the server, log in as an SCEPAdmin domain user.
From Server Manager, click Manage > Add Roles and Feature.
Click Server Roles, select Active Directory Certificate Services and all its features, and then click Next.
From the AD CS Role Services section, clear Certification Authority.
Select Network Device Enrollment Service and all its features, and then click Next.
From the Web Server Role (IIS) Role Services section, retain the default settings.
After installation, click Configure Active Directory Certificate Services on the destination server.
From the Role Services section, select Network Device Enrollment Service, and then click Next.
Select the SCEPSvc service account.
From the CA for NDES section, select either CA name or Computer name, and then click Next.
From the RA Information section, specify the information, and then click Next.
From the Cryptography for NDES section, do the following:
- Select the appropriate signature and encryption key providers.
- From the Key length menu, select the same key length as the CA server.
Click Next.
Complete the installation.
You can now access the NDES server from a web browser as an SCEPSvc user. From the NDES server, you can view the CA certificate thumbprint, the enrollment challenge password, and the validity period of the challenge password.