http://technet.microsoft.com/en-us/library/hh831498.aspx
Depending upon your Active Directory Domain Service (AD DS) configuration,
you may be able to implement a Managed Service Account or Group Managed Service Account for NDES.
I tried this under Windows Server 2012 R2 with a Managed Service Account not gMSA. But both the GUI and the powershell cmdlet Install-AdcsNetworkDeviceEnrollmentService needs a password for installation. Null will not work.
Setting the password before with -AccountPassword don't work, too. I think the password will be resetted automatic after setup. Is there a solution?