MSEndpointMgr
certificate of practical completion

It resists the tyranny of perfectionism. How many buildings have never been occupied because someone chased one last flaw? How many projects bled to death on the altar of "just a little more"? The certificate cuts that knot. It says: You may live here now, even with the crack in the tile. And yet, for those who built it, the certificate carries a quiet grief. The superintendent’s signature is a goodbye. The site that was once a second home—full of noise, mud, camaraderie, crisis—goes silent. The trailers are hauled away. The porta-potties vanish. The contractor’s team disperses to other drawings, other holes in other ground.

Practical Completion is the moment the building stops belonging to its makers and begins belonging to the world. That is beautiful. And it is also a small death. Ultimately, the Certificate of Practical Completion is a document of trust. Not blind trust, but structured trust. It trusts that the defects list will be honored. It trusts that the client will not demand the impossible. It trusts that time—the latent heat of concrete curing, the settling of beams, the first winter’s expansion and contraction—will reveal what the walkthrough could not.

So the next time you see that certificate—framed in a project manager’s office, attached to a final invoice, signed in triplicate—do not mistake it for bureaucracy. It is a monument to the courage of stopping. It is the legal form of a profound human truth: that nothing is ever perfect, but something can, at last, be ready .

Notice the words: minor , intended purpose . These are not absolutes. They are negotiations. Practical Completion is the moment a project stops being a promise and becomes a place. The scaffolding falls away. The dust settles—not entirely, but enough. The client can move in, store goods, turn on the lights, lock the doors. Life, imperfect and urgent, can now inhabit the shell.

A building is never finished. It only reaches practical completion. The certificate does not lie about this. It merely draws a line in the sand and says: From here, we care for it together.

This is not a failure. This is a reckoning.

We are taught to worship grand openings—ribbon cuttings, keys handed over, applause in a finished lobby. But the deeper truth is that endings are never clean. A building is never truly done . The Certificate of Practical Completion is the legal poetry that acknowledges this ache. Legally, Practical Completion means the works are complete except for minor defects and omissions that do not prevent the building from being used for its intended purpose.

The Certificate of Practical Completion is the legal seal on that reckoning. It transforms a chaotic construction site into a building —a noun, not a verb. From that moment, risk shifts. Insurance thresholds change. The clock starts ticking on the defects liability period. The contractor is no longer a builder but a guarantor. The client is no longer a spectator but a custodian. There is something almost theological about this document. It echoes the ancient idea of enough —the Sabbath, the harvest’s end, the moment the potter lifts the vessel from the wheel. In a culture addicted to the unfinished (the endless software update, the perpetual renovation, the scroll without bottom), Practical Completion declares: This chapter closes. Receive what is here.

13 comments

  • Hello,

    We followed your guide to the letter on a 2016 and 2019 server but we keep running into the problem that the SCEP application pool keeps crashing for no real reason. We already ruled out a mistake in the templates or wrong CA certs in the intermediate.
    We can see the Cert requests arrive but IIS dies everytime we see this in the NDES log:

    NDES COnnector:
    Sending request to certificate registration point. NDESPlugin 18-4-2019 17:04:05 3036 (0x0BDC)

    Event viewer just shows us that w3wp.exe has crashed and that the faulty module is ntdll.dll.

    We’ve been banging our heads against this problem for a week now so we hope you have any idea where to look.

    Regards,
    Herman

  • Nick, your stuff is amazing as always! .NET 3.5 appears to be required, so may be worth mentioning somewhere since some installations will need to specify an alternate path for that.

    Using your script, I was failing on “Attempting to install Windows feature: Web-Asp-Net” and it wasn’t until I manually added 3.5–specifying the alternate path to the Server installation media–that I could continue.

  • Does this work for Android for Work or Android Enterprise devices? I can’t find the certificate issued to the end mobile devices even – iOS?

  • Hey Nickolay,

    there are two mistakes in your two pictures showing the configuration of the AAP. In the internal URL field you have to write https instead of http, because of the later binding / requiring of SSL. Your other older posts showing this also with https configured.

    Best regards and nice work!,
    Philipp

    • I’ve wasted way too much time troubleshooting this before I checked the IIS log files and they showed port 80. After changing AAD Proxy to HTTPS everything works.

      Great guide though!

  • It appears that the script is expecting to find only 1 client authentication certificate with the specified subject. Could you modify it to handle cases where there are multiple certificates with the same subject?

  • Hello – Is there a mistake with the steps regarding the client and server certificates? At first you emphasized the points of each type which in turn have different Extended Key Usages. Are you stating to use the same template that contains both types?

  • Awesome step by step guide, many thanks. As per usual the MS TechNet lacks a lot of steps and inside information. Regarding the two certs, can they also be 3rd party and trusted certs (wildcard) ?

Sponsors

Categories

MSEndpointMgr.com use cookies to ensure that we give you the best experience on our website.