A 503 from the NDES endpoint (/certsrv/mscep/mscep.dll) means IIS accepted the connection
but the SCEP application pool is not running. IIS disables an application pool automatically
after repeated worker-process failures (rapid-fail protection), so a 503 usually indicates
the pool crashed and was switched off — every device hitting the URL fails until it is fixed.
HTTP 503
NDES returns HTTP 503 Service Unavailable
What it means
Common causes
The SCEP application pool's identity (the NDES service account) has an expired or changed password, so the worker process cannot start.
Rapid-fail protection disabled the pool after repeated crashes — often caused by expired NDES RA certificates or a broken policy module.
The pool was stopped manually (or by patching/reboot ordering) and never restarted.
How to fix it
In IIS Manager, check Application Pools: the SCEP pool must be Started. Start it and immediately watch whether it stops again — a pool that re-stops within seconds is crashing, not merely stopped.
Reset/verify the NDES service account password and update it on the application pool identity (Application Pools > (pool) > Advanced Settings > Identity).
Check the System and Application event logs on the NDES server for WAS/W3SVC events around the failure time — they name the crashing pool and the reason.
Verify the NDES RA certificates (CEP Encryption, Exchange Enrollment Agent) in the computer certificate store have not expired; expired RA certs are the classic cause of a crash-looping NDES pool.
Frequently asked
Why did NDES stop working for everyone at the same time?
NDES is a single choke point: one stopped application pool, one expired RA certificate or one service-account password change breaks every SCEP enrolment simultaneously. Check the app pool state and RA certificate expiry first.