Change the static password of the Network Device Enrollment Service (NDES).

Assume the following scenario:

• An NDES server is configured on the network.
• The NDES server is configured to use a static password.
• The static password should be changed.

The Network Device Enrollment Service (NDES) provides a way for devices that do not have an identifier in Active Directory (for example, network devices such as routers, switches, printers, thin clients, or smartphones and tablets) to request certificates from a certification authority. For a more detailed description, see the article "Network Device Enrollment Service (NDES) Basics„.

This is achieved by deleting the EncryptedPassword value below the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP\EncryptedPassword

Afterwards, the NDES service must be restarted by the iisreset command.

Now the NDES administration web page (mscep_admin) must be called once so that a new password is generated.

Of course, the new static password must now be entered in the corresponding applications that use the NDES.

Changing the password regularly

See article "Regular password change when configuring the Network Device Enrollment Service (NDES) with a static password.„.

Related links:

• The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot create or modify the registry key Software\Microsoft\Cryptography\MSCEP\EncryptedPassword."
• The Network Device Enrollment Service (NDES) logs the error message "The Network Device Enrollment Service cannot be started (0x80070002). The system cannot find the file specified."
• Configuring the Network Device Enrollment Service (NDES) to work with a static password.