Active Directory · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft ADCSDeployment reference: Installs the NDES role service. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for Install-AdcsNetworkDeviceEnrollmentService. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / ADCSDeployment · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-ApplicationPoolIdentity
Indicates the identity that the Network Device Enrollment Service (NDES) uses when communicating with the certification authority (CA). This parameter is only valid when NDES is using a remote CA. If the CA is local, the application pool identity account cannot be used.
-CAConfig
Specifies the remote certification authority (CA) that the Network Device Enrollment Service uses. This parameter is mandatory when used within the ApplicationPoolIdentity parameter. Do not use this parameter when a local CA is installed.
-Confirm
Prompts you for confirmation before running the cmdlet.
-Credential
Specifies a PSCredential object that this cmdlet uses to connect to the NDES role service. To obtain a credential object, use the Get-Credential cmdlet. For more information, type Get-Help Get-Credential. The NDES must be installed on a server that is a member of an Active Directory Domain Services (AD DS) domain. If NDES is configured to use a Standalone CA, then an account that is a member of the local Administrators on the CA is required. If NDES is installed to use an Enterprise CA, then using an account that is a member of Domain Admins group is required.
-EncryptionKeyLength
Specifies the encryption key length. This option is not valid if you use existing keys during installation.
-EncryptionProviderName
Specifies the name of the encryption provider, such as the name of cryptographic service provider (CSP).
-Force
Forces the command to run without asking for user confirmation.
-RACity
Specifies the city of the registration authority.
-RACompany
Specifies the organization or company that the registration authority represents.
-RACountry
Specifies the country/region of the registration authority.
-RADepartment
Specifies the department of the registration authority.
-RAEmail
Specifies the email address of the registration authority.
-RAName
Specifies the name of the NDES registration authority.
-RAState
Specifies the state or province (geographical political boundary), if applicable, of the registration authority.
-ServiceAccountName (required)
Specifies the name of the account that is used by the Network Device Enrollment Service.
-ServiceAccountPassword (required)
Specifies the password of the service account that is used by the Network Device Enrollment Service.
-SigningKeyLength
Specifies the signing key length.
-SigningProviderName
Specifies the name of the signing device.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.
Prerequisites
Windows with the ADCSDeployment module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
This command displays the default NDES settings that will be configured if it is installed. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.