If you use Microsoft SCEP service, you *need* enrollment password (it is always present and autogenerated for you out of the box, can be obtained from /CertSrv/mscep_admin).
You can make sure this password never changes by setting HKLM\SOFTWARE\Microsoft\Cryptography\MSCEP\UseSinglePassword = 1 (DWORD) on SCEP server – so you only need to configure it once in ThinOS profile and never touch it again