/certsrv/mscep_admin is the page that hands out one-time SCEP challenge passwords. A 401,
or a page that loads but shows a permission message instead of a password, means the account
requesting the challenge is not authorised: the page requires Windows authentication and the
caller must hold Enroll permission on the certificate template(s) NDES is configured to use.
HTTP 401 (mscep_admin)
mscep_admin returns 401 or refuses to show a challenge password
What it means
Common causes
The requesting user lacks Enroll permission on the template(s) named in the MSCEP registry keys.
Browser did not perform integrated Windows authentication (accessing via a hostname outside the intranet zone, or from a non-domain machine).
IIS authentication settings on the mscep_admin application were changed from the defaults.
How to fix it
On the CA, open the template's Security tab and grant the admin user (or a group) Read + Enroll; NDES checks the user requesting the password, not just the service account.
Access the page with a URL in the browser's intranet zone (short hostname or a zone-mapped FQDN) so Windows auth happens automatically, or enter domain credentials when prompted.
In IIS Manager, confirm Windows Authentication is enabled (and Anonymous disabled) on the mscep_admin application.