If you have installed the MIM 2016 version with SP1 integrated, you will have PCNS version 4.4.1237.0 on your writable DCs if you are using PCNS at all
Figure 1: PCNS Version/Build 4.41237.0 Installed On A Writable DC
–
However as soon as you try to start the “Password Change Notification Service” service, it stops immediately. When you look in the Application event log, you will see:
Figure 2: PCNS Error About An Untrusted Root Certificate That Is Part Of A Certificate Chain Used To Sign The Binaries
–
The Password Change Notification service executable "C:\Program Files\Microsoft Password Change Notification\pcnssvc.exe" failed while verifying the file signature. The service will not be started and password notifications will not be sent.
pcnsfltapi.cpp (525): A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
–
To solve this issue, Microsoft has released a new version of the PCNS package, which can be downloaded from here.
–
Funny enough the new PCNS package carries the same version/build as MIM 2016 after applying the SP1 update package, but it does not mention MIM 2016 (with SP1) in the release notes. It does also not state it can run on Windows Server 2016 writable DCs.
Well I did install it on a Windows Server 2016 writable DC and it actually works also works with MIM 2016 SP1! 
–
Cheers,
Jorge
———————————————————————————————
* This posting is provided "AS IS" with no warranties and confers no rights!
* Always evaluate/test yourself before using/implementing this!
* DISCLAIMER: https://jorgequestforknowledge.wordpress.com/disclaimer/
———————————————————————————————
############### Jorge’s Quest For Knowledge #############
######### http://JorgeQuestForKnowledge.wordpress.com/ ########
———————————————————————————————
Jorge's Quest For Knowledge! 