diff --git a/changes/28488-ms-utf16-endianness b/changes/28488-ms-utf16-endianness
new file mode 100644
index 0000000000..159a51e212
--- /dev/null
+++ b/changes/28488-ms-utf16-endianness
@@ -0,0 +1 @@
+Fixed issue where NDES SCEP admin page was parsed using wrong UTF16 endianness.
diff --git a/ee/server/service/scep_proxy.go b/ee/server/service/scep_proxy.go
index 90039b9087..b65a7e8b1f 100644
--- a/ee/server/service/scep_proxy.go
+++ b/ee/server/service/scep_proxy.go
@@ -239,9 +239,9 @@ func (s *SCEPConfigService) GetNDESSCEPChallenge(ctx context.Context, proxy flee
 			resp.StatusCode)})
 	}
 	// Make a transformer that converts MS-Win default to UTF8:
-	win16be := unicode.UTF16(unicode.BigEndian, unicode.IgnoreBOM)
-	// Make a transformer that is like win16be, but abides by BOM:
-	utf16bom := unicode.BOMOverride(win16be.NewDecoder())
+	win16le := unicode.UTF16(unicode.LittleEndian, unicode.IgnoreBOM)
+	// Make a transformer that is like win16le, but abides by BOM:
+	utf16bom := unicode.BOMOverride(win16le.NewDecoder())
 
 	// Make a Reader that uses utf16bom:
 	unicodeReader := transform.NewReader(resp.Body, utf16bom)
diff --git a/ee/server/service/scep_proxy_test.go b/ee/server/service/scep_proxy_test.go
index fd43a15965..bfed459870 100644
--- a/ee/server/service/scep_proxy_test.go
+++ b/ee/server/service/scep_proxy_test.go
@@ -70,7 +70,7 @@ func TestValidateNDESSCEPAdminURL(t *testing.T) {
 		require.NoError(t, err)
 		byteData := make([]byte, len(datUTF16)*2)
 		for i, v := range datUTF16 {
-			binary.BigEndian.PutUint16(byteData[i*2:], v)
+			binary.LittleEndian.PutUint16(byteData[i*2:], v)
 		}
 		return byteData
 	}