Installing NDES on Windows 2025, Virtual Directories "CertSrv\mscep" and "mscep_admin" are missing.

If the SCEP Application Pool exists and is running, but both CertSrv/mscep and mscep_admin virtual directories were never created, then IIS itself is probably not the issue. Those virtual directories are normally created during the NDES post-deployment configuration.

A few things I would check:

• Verify that the Network Device Enrollment Service is fully configured in Server Manager > AD CS Configuration, not just installed as a role.
• Review the Application event log and Microsoft-Windows-CertificateServices-Deployment logs for any warnings or errors during the NDES configuration phase.
• Confirm that the NDES service account has the required permissions and that the Registration Authority (RA) certificates were successfully created. If RA certificate enrollment fails, the IIS virtual directories may not be provisioned.
• Verify that the CEP Encryption and Enrollment Agent templates are published and that the NDES service account can enroll for the required certificates.
• Check whether the following physical folders exist:
  • %windir%\System32\CertSrv\mscep
  • %windir%\System32\CertSrv\en-US (or the appropriate language folder)

If the folders exist but the IIS virtual directories do not, it may simply be an IIS provisioning failure. If the folders themselves are missing, the NDES configuration likely never completed successfully.

One additional question: Is this a clean Windows Server 2025 installation, or was it upgraded from an earlier version? Also, are you seeing any events from Microsoft-Windows-CertificateServices-Deployment indicating that the MSCEP virtual directories failed to be created?

Given that the SCEP AppPool is present but the mscep and mscep_admin applications are not, I'd also be interested to know whether anyone else has reproduced this on a clean Windows Server 2025 installation. If so, it could indicate a regression specific to the NDES provisioning process on Server 2025.

Hi Ib, missing CertSrv/mscep and mscep_admin usually means the role bits installed but the AD CS post-deployment configuration did not complete correctly. I’d confirm the NDES role service is installed, IIS is present, then rerun AD CS configuration with the correct service account and permissions. Also check the ADCS deployment logs and IIS Default Web Site before reinstalling.