808.1x on wms 3.2

I need to implement 802.1x in our env. We are using wms 3.2 and wyse 3040 with ThinOS 9.1.2101. We would like to set up automatic cert.enrolment.
We use MS entreprise CA and scep server.

I was studying @confgen Installation-and-configuration-of-MS-SCEP-and-ThinOS.pdf.

Here is problem. My aplication pool in IIS uses account “scepserv”. This account has also rights to enroll certs on CA server. I can logon to http://xxxxxx/CertSrv/mscep_admin/ with this account and passw and I can see hash value of CA and password.
I set up in wms:
Request URL: xxxx/CertSrv/mscep/mscep.dll
CA Certificate Hash Type:MD5
CA Certificate Hash: 05AD70A1 7FAF8980 0DB635B0 C0F4A01E
Enrollment Password: <empty>
SCEP Administrator URL:
https://xxxxxx/CertSrv/mscep_admin/
Admin User:scepserv
Admin User Password:••••••••••••••••
Admin User Domain:xxxxx.xx

But cert.enrolment always fail with log: scep auto enroll failed: scep getting enrollment password request failed
Also in server’s sec.event I see that wyse is authenticating but faild:
Subject:
Security ID: NULL SID
Account Name: –
Account Domain: –
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: scepserv
Account Domain: xxx.xx
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A
Network Information:
Workstation Name: WT6C2B5937F97F
Source Network Address: 10.x.x.x
Source Port: 34682

I can interactively log to scep server with scepserv account.
Am I missing something?