SCEP Certificate Enrollment Through Microsoft NDES May Fail with Event ID 60

Following KB5126651, SCEP certificate enrollment and renewal through Microsoft NDES may fail with third-party MDM solutions due to changes addressing CVE-2026-69802. A temporary workaround is available pending a permanent fix.

SOTI MobiControl;SOTI Connect

Customers using Microsoft Network Device Enrollment Service (NDES) with third-party Mobile Device Management (MDM) solutions, such as SOTI MobiControl or SOTI Connect, may experience Simple Certificate Enrollment Protocol (SCEP) certificate enrollment or renewal failures following the installation of Microsoft security update KB5126651.

In affected environments, the NDES server may generate Event ID 60 when processing SCEP certificate enrollment or renewal requests.

Microsoft has confirmed that this behavior is related to security changes introduced in KB5126868, KB5126651, KB5126655, and KB5126646 as part of the mitigation for CVE-2026-69802 – Network Device Enrollment Service (NDES) Remote Code Execution Vulnerability.

Microsoft has provided a temporary registry-based workaround for affected environments while work toward a permanent resolution continues.

This article outlines the issue, describes the observed symptoms, provides Microsoft's temporary workaround, and summarizes the current status of the permanent fix.

For additional details about the security vulnerability and associated updates, refer to the Microsoft Security Update Guide for CVE-2026-69802.

This issue may occur on Microsoft Windows Server environments where one of the following security updates has been installed:

• Windows Server 2016 - KB5126868
• Windows Server 2019 - KB5126651
• Windows Server 2022 - KB5126655
• Windows Server 2025 - KB5126646

The affected servers must be running the Microsoft Network Device Enrollment Service (NDES) and processing SCEP certificate enrollment or renewal requests through a third-party MDM solution.

After installing one of the affected Microsoft security updates listed in the Environment section, customers may experience one or more of the following symptoms:

• CA-SCEP certificate enrollment fails, affecting both new certificate issuance and certificate renewal. 
• The NDES server records Event ID 60 when processing the affected certificate enrollment requests. 
• The issue begins after installation of Microsoft security updates as mentioned above, released on October 13, 2026. 

Note: Certificate enrollment failures can occur for reasons unrelated to these Microsoft security updates. Before applying the workaround described in this article, verify that the affected environment meets the requirements outlined in the Environment section and that the observed symptoms match the scenario described above.

SOTI is working with Microsoft to identify and establish a permanent, Microsoft-supported solution for NDES certificate enrollment and renewal with SOTI MobiControl and SOTI Connect.

The long-term objective is to ensure compatibility with Microsoft's applicable security requirements without relying on the temporary AllowSIDInSANURI registry workaround.

As part of this effort, SOTI and Microsoft are evaluating the appropriate NDES policy module and certificate request validation mechanisms required to support integration with third-party MDM solutions.

In the meantime, customers experiencing the specific issue described in this article may consider applying Microsoft's temporary workaround, subject to their organization's security policies, risk assessment, and change-management requirements.

Further guidance will be provided as more information becomes available and a permanent solution is established.

Microsoft has provided a registry setting that can be used as a temporary mitigation in affected environments where the SCEP certificate enrollment workflow requires a Security Identifier (SID) to be included in the Subject Alternative Name (SAN) Uniform Resource Identifier (URI).

To apply the workaround, configure the following registry value on the NDES server:

Registry Configuration

Registry Value Behavior

The AllowSIDInSANURI registry value controls whether a SID is permitted in the SAN URI:

• 0 or value not defined: SID in the SAN URI is not allowed.
• 1 or any non-zero value: SID in the SAN URI is allowed.

Important Security Considerations

This registry setting bypasses applicable Microsoft security hardening and is intended only as a temporary workaround.

Before implementing this change, organizations should:

• Evaluate the associated security implications and risks.
• Follow internal security review and change-management procedures.
• Obtain the necessary approvals before modifying the registry.

Once a permanent, supported solution based on an appropriate NDES policy module is implemented, remove the temporary registry setting or revert it to its original configuration to restore the applicable Microsoft security protections.

Recommended Validation

After applying Microsoft's temporary registry workaround, perform the following validation steps to confirm that SCEP certificate enrollment and renewal are functioning as expected:

1. Test new certificate enrollment: Initiate a new certificate enrollment request from an affected device.
2. Test certificate renewal: Initiate a certificate renewal request from an affected device.
3. Verify NDES processing: Confirm that both certificate requests are successfully processed by the NDES server.
4. Verify certificate issuance: Confirm that the expected certificates are successfully issued and delivered to the affected devices.
5. Check event logs: Verify that Event ID 60 is no longer generated on the NDES server for the tested enrollment transactions.

If the Issue Persists

If certificate enrollment or renewal continues to fail after applying the workaround:

• Collect the relevant NDES server event logs and certificate enrollment logs.
• Record the affected device details and the time of the failed enrollment or renewal attempts.
• Contact SOTI Support and provide the collected logs and troubleshooting information for further investigation.