I am aware NDES needs to run on a 2008 R2 enterprise server but it is generally recommended not to run on a CA server to limit surface attack area. My question is does the entire CA infrastructure (all tiers) need to be 2008 AD CS in order to support a server running NDES ?

Hi, Just checking in to see if the information provided was helpful. Please let us know if you would like further assistance. Have a great day! Regards Kevin TechNet Subscriber Support If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

Hi, As this thread has been quiet for a while, we will mark it as Answered as the information provided should be helpful. If you need further help, please feel free to reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish. BTW, wed love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems. Thanks for your understanding and efforts. Best Regards Kevin TechNet Subscriber Support If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

Thanks Vadims. So it does not need to be running 2008 R2 AD CS but do additional benefits come with running 2008 R2 AD CS ?

it depends. I don't think that there are any benefits in NDES context, you may get benefits from other AD CS features in Windows Server 2008 R2.My weblog: http://en-us.sysadmins.lv PowerShell PKI Module: http://pspki.codeplex.com Windows PKI reference: on TechNet wiki