0x80072EFD is "A connection with the server could not be established" (Win32 12029).
Name resolution succeeded, but the device could not open a connection to the SCEP endpoint:
the port is blocked, the listener is down, or an intermediary refused the connection.
0x80072EFD
Cannot connect to the SCEP server
What it means
Common causes
Firewall or proxy blocks outbound HTTPS to the SCEP endpoint from where the device sits.
The NDES/SCEP service or its reverse proxy is down, so nothing is listening on the published port.
The endpoint is published on a non-standard port that egress rules do not allow.
How to fix it
Test from a failing device:
Test-NetConnection <scep-hostname> -Port 443— a failed TCP test confirms a network-level block rather than a certificate or profile problem.Confirm the service is up end-to-end: browse the SCEP URL from outside the corporate network and check the reverse proxy / application proxy connector status.
Review proxy and firewall logs for the device's requests; TLS-inspecting proxies frequently break SCEP and should exempt the endpoint.