In standalone NDES (without the Intune policy module), an admin fetches a one-time challenge
password from /certsrv/mscep_admin and puts it in the device's SCEP request. NDES rejects
the request when that password is wrong, already used, expired, or has been pushed out of the
small in-memory cache. Nothing is wrong with the device's cryptography — the proof-of-authorisation
failed.
Challenge password rejected
NDES one-time challenge password rejected
What it means
Common causes
The password expired: NDES challenge passwords are valid for 60 minutes by default.
The password was already consumed — they are single-use, so a retry with the same password fails.
The password cache overflowed: NDES caches only 5 outstanding passwords by default (
PasswordMax), so generating a sixth silently invalidates the oldest.Copy/paste errors — trailing whitespace from the mscep_admin page is a classic.
How to fix it
Generate a fresh password from
/certsrv/mscep_adminimmediately before enrolling, and use it once.Adjust defaults if your workflow needs it:
PasswordValidity(minutes) andPasswordMaxvalues underHKLM\SOFTWARE\Microsoft\Cryptography\MSCEP— restart IIS after changing them.For anything beyond occasional manual enrolments, move to a policy-module flow (Intune + Certificate Connector) or a cloud SCEP service so challenges are issued and validated automatically per-device.