Disclaimer as this has been commented on more than once:
This video is to act as a guide and not to be replicated directly in a production environment. The ndes service account has been given Domain Admin rights due to the server being Domain Controller, Root CA and NDES service. This is not something that should be done in production. The minimum required permissions for a ndes service account is that it needs to be a memebr of the local IIS_USRS group on the ndes server.
Video to show how to turn on an Windows 2012r2 NDES server and use it with MDM server Jamf Pro
as a bonus NoMAD to access User AD cert
