How to define challenge password (SCEP) manually in windows 2008 Enterprise CA

Question

reference doc (I can't past link, so I just list doc name):
Network Device Enrollment Service (NDES) in Active Directory Certificate Services (AD CS)
==
The doc said this one-time password is random.
We can modify Registry to change password length and valid time.
But I can't find how to define this password manually.
e.g.  I want to set 3 password in password list/cache : aaaaa, bbbb, cccc.
Someone know how to does this ?   
Thanks.

Answer 1

I am a bit late to this post, but I wanted to point out that a single, static SCEP password is common in the SMB market. In order configure it:
Configure service to function in a single-password mode by creating a REG_DWORD value UseSinglePassword and setting it to 0x1.
Give Full Control permission to the account used to run NDES for the HKEY_LOCAL_MACHINE\Microsoft\Cryptography\MSCEP registry key. This step only required if you have installed KB959193 hotfix.
In the IIS Manager snap-in, navigate to the SCEP application pool and in Advanced Settings set Load User Profile to true.
If you’ve configured NDES to run under some user account, logon interactively with that user account onto the machine where NDES is installed to force creation of a user profile for that account. This is a one-time operation, the user doesn’t need to stay
interactively logged on while NDES is running.
After above steps are complete, the NDES will use only one password for all certificate requests. This password can be obtained in the same way as a one-time password by going to the admin page of the NDES. Administrators can deploy that password to their
devices in an automated way.