Renew Exchange Enrollment Agent (Offline)

Question

i have to renew CEP and Exchange Agent, CEP is eailer, but Exhcnage agent i have some hesitation,
my company have 1 standalone Root CA, 2 Enterprise CA, 2 NDES respectively
i read articles

use GUI
https://www.sysadmins.lv/retired-msft-blogs/xdot509/steps-for-renewing-ndes-service-certificates.aspx

1. does step 10 enroll the cert at EntCA? and step 23 import to NDES server?
2. which permission or group is better for do this process?

use command and renew
https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/renewal-of-enrollment-agent-certificate-fail

1. does this one also run at EntCA and import to NDES server?
2. need to change private key permission to IIS service acount?

use command and new one
https://msendpointmgr.com/2020/06/15/how-to-renew-ndes-service-certificates-for-usage-with-microsoft-intune/

1. at topic Renew expired Enrollment agent certificate, would this better than the renew above?
2. also run at EntCA and import to NDES?
3. need to change private key permission to IIS service acount?

any document define all accounts/groups about CA?

sorry i have many questions

Answer 1

Please cancel the question