Install-NdesServer

This script installs and configures the Network Device Enrollment Service (NDES) role on Windows Server to support the Microsoft Intune Certificate Connector. It also configures the server to use a specific TLS certificate and enrollment certificate template for NDES.

In addition, this script performs several post-installation tasks to ensure the NDES service is properly configured, optimized, and secured.

As part of post-installation hardening, permissions on the HKLM\SOFTWARE\Microsoft\Cryptography\MSCEP registry key are restricted to SYSTEM, Administrators, and the NDES service account, and auditing of configuration changes to this key is enabled (Security log events require the 'Audit Registry' subcategory to be enabled via Group Policy). If the Microsoft Intune Certificate Connector service runs as a custom account instead of SYSTEM, grant that account read access to this registry key manually. Note that changing the SCEP application pool identity after installation will cause NDES to fail until the registry key permissions are updated.

In addition, IIS is hardened by removing the NDES administration page (mscep_admin) IIS application and its orphaned configuration location, adding a request filtering hidden segment to block requests to the administration page path, and disabling Windows authentication (anonymous only) for the Default Web Site and the SCEP application. Because Windows authentication is disabled for the entire site, the server must be dedicated to NDES and must not host other IIS applications that require authentication.

IMPORTANT NOTE: This script is for configuring NDES to support the Microsoft Intune Certificate Connector. Settings configured by this script will not work with other deployment scenarios.