I have reproduced the same NDES/SCEP failure on clean Windows Server 2022 and Windows Server 2025 Datacenter installations. Both use an Enterprise Subordinate CA running on Windows Server 2019. The NDES role installs successfully through PowerShell, and the required RA certificates are issued correctly.
Every request to the SCEP endpoint fails, including a basic GetCACaps request, with an IIS 500.0 response from IsapiModule and error 0x80070057 (ERROR_INVALID_PARAMETER). The application log reports that NDES cannot start and cannot retrieve one of its required certificates.
Live debugging of w3wp.exe shows that mscep!GetExtensionVersion executes and returns FALSE. IIS then reads 0x80070057 with GetLastError(), clears the extension's HttpExtensionProc pointer, and unloads mscep.dll. As a result, the actual SCEP handler is never reached.
I have already ruled out certificate EKUs, key usage and KeySpec, CSP versus KSP, private-key permissions, template permissions, CA certificate cleanup, CRL reachability, IIS mappings and application-pool settings, servicing corruption, endpoint security interference, the service-account profile, LocalSystem testing, and different RA names. The installations are new and have never worked. There is one issuing CA, and no Intune certificate connector is involved.
Has anyone encountered GetExtensionVersion returning FALSE in NDES and identified the internal condition behind it? I am particularly interested in a known bug, required hotfix, or configuration setting that could make the compiled NDES initialization code reject the installation before processing SCEP requests.
1 Answer
Since both systems are fresh installations that have never worked, the useful comparison is probably with a known-good NDES deployment rather than with the two affected operating systems. The key details to verify are whether there is only one issuing CA and whether any certificate-management connector or similar integration is involved. Those details can change which NDES initialization path is used, although the comments do not identify a confirmed fix.
There is no working reference server at the moment. The deployment uses one issuing CA, and no Intune certificate connector is involved. I tested Server 2022 after seeing the same failure on Server 2025, so the issue appears independent of that OS version.