---
title: Enabling Kerberos Authentication between EPMM and the SCEP and LDAP servers
slug: device-management-guide/android/enabling-kerberos-authentication-between-epmm-and-the-scep-and-ldap-servers
createdAt: 2026-10-06T07:48:37.614Z
---

You can use Kerberos authentication to communicate between Ivanti EPMM and the SCEP and LDAP servers. The following sections discuss how to enable Kerberos authentication on servers and Ivanti EPMM.

## Pre-configuration steps

**Procedure**

1. In the Active Directory server, check that a service account is available.
2. In the SCEP Server, check that the service account is a member of the local IIS\_USRS group.
3. In the CA server certificate template that is being provisioned, check that the service account has enroll permission.
4. In the CA server certificate template that is being provisioned, check that the service account has enroll permission.

## Configuring Windows servers

**Procedure**

1. Run the following command on a domain controller:

:::CodeblockTabs{indent="1"}
```bash
setspn -s http/<SCEP-SERVER-FQDN> <domain>\<service account>
```
:::

:::Paragraph{indent="1"}
In **Active Directory Users and Computers** click the **Delegation** tab of the service account:
:::

:::Paragraph{listStyleType="decimal" indent="2"}
Under **Trust this user for delegation to specified services only**, select **Use Kerberos Only**.
:::

:::Paragraph{listStyleType="decimal" listStart="2" indent="2"}
Click **Add** and add the SCEP server name.
:::

:::Paragraph{listStyleType="decimal" listStart="3" indent="2"}
Select the http service.
:::

:::Paragraph{listStyleType="decimal" listStart="4" indent="2"}
Click **OK**.
:::

2. Do the following in the IIS server to make sure that Application Pool credentials are used to decrypt Kerberos tickets:
   1. Check that the SCEP Application Pool is running under the service account.
   2. Disable Kernel mode and enable useAppPoolCredentials.
3. Make sure that **Negotiate** is the first choice in the **Authentication > Providers** dialog box.
4. Restart the IIS service.

## Configuring Kerberos

This section discusses how to configure Kerberos on Ivanti EPMM server.

### Configuring Kerberos settings in Ivanti EPMM

In **Ivanti EPMM Admin Portal > Settings > System Settings > Security > Outbound Kerberos Authentication**, enter the following:

Table: Outbound Kerberos Authentication

| UI Section                                                                                                                                                                                                                                                                                                                     | Choice                                                |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------- |
| Active Directory's Kerberos Realm                                                                                                                                                                                                                                                                                              | IVANTI.COM                                            |
| Corresponding Key Distribution Center (KDC) server                                                                                                                                                                                                                                                                             | [kdc.ivanti.com](http://kdc.ivanti.com/)              |
| Domains for outbound communication with Microsoft AD Certificate Services<br />(Hostnames (not case sensitive) must end in .ivanti.com or .IVANTI.COM)<br />- LDAP server: You can also use hostnames, such as: ad.ivanti.com<br />- SCEP/NDES server: You can also use hostnames, such as: ndes.ivanti.com or scep.ivanti.com |                                                       |
| Service user credentials                                                                                                                                                                                                                                                                                                       | user\@realm<br />For example: serviceuser\@IVANTI.COM |

## Enabling Kerberos authentication on the Microsoft SCEP Certificate Enrollment configuration

To enable Kerberos authentication, in the **Edit SCEP Certificate Enrollment Setting** window (**Policies\&Configs > Configurations > Edit existing or Add new > Certificate Enrollment > SCEP**) enable the checkbox **Prefer Kerberos authentication**.

## Enabling Kerberos authentication on the LDAP configuration

To change the LDAP configuration, in the **Modifying LDAP Setting** window (**Services > LDAP**), enable the **Kerberos authentication method** in the **Advanced** options.