ESC2 is an Active Directory Certificate Services (AD CS) exposure where a certificate template allows certificates to be issued with the Any Purpose Extended Key Usage (EKU), or with no EKU restrictions at all. Unlike certificates that are limited to a specific function, these certificates may be accepted for many different purposes depending on the application consuming them.
ESC2 is primarily a certificate template configuration issue. It is different from ESC1, which focuses on dangerous enrollment behavior, and ESC8, which focuses on vulnerable web enrollment endpoints. In ESC2, the concern is that a certificate intended for one purpose can become useful for many others because the template does not adequately restrict how issued certificates may be used.
While ESC2 by itself does not always result in privilege escalation or domain compromise, it removes an important security boundary. When combined with permissive enrollment permissions, authentication-capable templates, or other AD CS weaknesses, the overall risk can increase significantly.
What Is an Extended Key Usage (EKU)?
Every certificate contains information describing what it is intended to be used for. One of the most important extensions is Extended Key Usage (EKU). EKUs tell Windows and other applications which purposes a certificate should be trusted for.
Common EKUs include:
| EKU | Typical Use |
|---|---|
| Client Authentication | User and computer authentication |
| Server Authentication | TLS for web servers and services |
| Smart Card Logon | Smart card authentication |
| Secure Email | S/MIME email signing and encryption |
| Code Signing | Digitally signing software |
| Time Stamping | Signing timestamps |
Properly configured certificate templates include only the EKUs required for their intended purpose.
What Is the Any Purpose EKU?
The Any Purpose EKU (Object Identifier 2.5.29.37.0) indicates that a certificate may be considered valid for virtually any application that relies on EKUs. Similarly, certificates issued without an EKU extension may also be interpreted as valid for all purposes by many Windows components because there are no explicit usage restrictions. While exact behavior depends on the application and certificate chain validation, both configurations are generally considered overly permissive.
Microsoft recommends creating certificate templates that are narrowly scoped to specific business requirements rather than allowing unrestricted usage.
Why ESC2 Matters
Certificates often remain valid for months or years. If a certificate can be used for significantly more purposes than originally intended, it becomes much more valuable if compromised.
Potential risks include:
- Certificates usable across multiple authentication scenarios
- Increased value of stolen certificates
- Reduced separation between certificate types
- Greater impact from future template misconfigurations
- Increased opportunities for abuse when combined with other AD CS weaknesses
ESC2 is best viewed as a reduction in security boundaries rather than a single exploit.
ESC2 vs ESC1
Although both involve certificate templates, they represent different security problems.
| Risk | Primary Issue |
|---|---|
| ESC1 | Dangerous enrollment behavior allows requester-controlled identities to obtain authentication certificates |
| ESC2 | Certificates are issued with overly broad usage capabilities because EKU restrictions are absent or overly permissive |
| Overlap | A template may suffer from both ESC1 and ESC2, significantly increasing overall risk |
ESC1 determines who a certificate can represent. ESC2 determines what the certificate may be used for.
When Is ESC2 Dangerous?
The presence of an Any Purpose EKU alone does not automatically create a critical security issue. Administrators should evaluate the template as a whole.
Important questions include:
- Who can enroll?
- Does the template issue authentication-capable certificates?
- Is manager approval required?
- Are authorized signatures required?
- Can requesters supply subject information?
- Is auto-enrollment enabled?
- Is the issuing CA trusted for domain authentication?
- Are enrollment agent capabilities present?
Multiple small configuration issues often combine to create a much larger security problem.
Common ESC2 Conditions
ESC2 commonly involves certificate templates that:
- Include the Any Purpose EKU
- Have no EKU restrictions
- Allow broad enrollment permissions
- Issue certificates valid for long periods
- Are duplicated from older templates without review
- Remain published despite no longer serving a business purpose
Organizations frequently discover legacy templates that have remained unchanged for many years.
What Defenders Should Review
Begin by reviewing every published certificate template.
For each template determine:
- What business purpose does it serve?
- Is it still required?
- Which EKUs are configured?
- Who can enroll?
- Who can modify the template?
- Does it support client authentication?
- Does it require manager approval?
- Are authorized signatures required?
- Does it allow auto-enrollment?
- When was it last reviewed?
Every published template should have a documented owner and a clearly defined purpose.
PowerShell: Find Enterprise Certificate Authorities
Use Active Directory to identify Enterprise Certification Authorities.
$ConfigNC = (Get-ADRootDSE).configurationNamingContext
Get-ADObject `
-SearchBase "CN=Enrollment Services,CN=Public Key Services,CN=Services,$ConfigNC" `
-LDAPFilter "(objectClass=pKIEnrollmentService)" `
-Properties dNSHostName, certificateTemplates |
Select-Object Name, dNSHostName, certificateTemplatesReview which templates are published by each CA.
PowerShell: Review Published Certificate Templates
The ADCSAdministration module can enumerate templates published by a Certification Authority.
Get-CATemplateCompare the published templates against your documented inventory. Investigate templates that are unfamiliar or no longer required.
PowerShell: Review Template EKUs
If you use the PSPKI module, you can inspect certificate template properties in greater detail.
Get-CertificateTemplate |
Select-Object DisplayName, EnhancedKeyUsageReview templates that contain:
- Any Purpose
- Empty EKU lists
- Unexpected authentication EKUs
- Multiple unrelated EKUs
Inventorying template EKUs regularly makes it easier to identify configuration drift over time.
GUI: Review Certificate Templates
Open Certification Authority on the CA. Expand Certification Authority > Certificate Templates
Note every published template.
Next, open the Certificate Templates management console.
For each template:
- Open Properties.
- Review the Extensions tab.
- Select Application Policies.
- Review configured EKUs.
- Determine whether Any Purpose is present.
- Review enrollment permissions.
- Review issuance requirements.
- Confirm the template is still required.
What Else Should Be Reviewed?
EKUs are only one part of the security model.
Also review:
- Enrollment permissions
- Template ACLs
- Authorized signatures
- Manager approval
- Subject name configuration
- Auto-enrollment settings
- Authentication-capable EKUs
- Certificate validity periods
- Published templates on each CA
- Unused templates
Secure AD CS requires reviewing both template configuration and who is allowed to use each template.
How to Reduce ESC2 Exposure
Mitigation usually involves reducing unnecessary certificate capabilities.
Common recommendations include:
- Remove the Any Purpose EKU unless there is a documented requirement.
- Create separate templates for different business functions.
- Publish only templates that are actively used.
- Restrict enrollment permissions.
- Require manager approval where appropriate.
- Require authorized signatures for sensitive templates.
- Reduce certificate validity periods where practical.
- Periodically review template configuration.
- Audit AD CS during regular security assessments.
The principle of least privilege applies to certificate templates just as it does to user permissions.
Safe Remediation Workflow
Rather than modifying templates immediately:
- Inventory all published templates.
- Identify template owners.
- Document business requirements.
- Identify templates using Any Purpose or unrestricted EKUs.
- Review enrollment permissions.
- Review issuance requirements.
- Test template changes in a non-production environment.
- Publish replacement templates if needed.
- Remove unused templates after validation.
- Continue monitoring certificate issuance.
Changing certificate templates without understanding existing dependencies can interrupt smart card authentication, VPN authentication, Wi-Fi authentication, application certificates, or automated enrollment processes.
Detection Opportunities
Organizations should monitor for:
- New certificate templates
- Template modifications
- EKU changes
- Changes to enrollment permissions
- Changes to issuance requirements
- Unexpected certificate requests
- Authentication certificates issued from rarely used templates
- Newly published templates
- Changes to CA configuration
Useful log sources include:
| Source | Purpose |
|---|---|
| Certification Authority logs | Certificate requests and issuance |
| Security logs | Authentication activity |
| Directory Service logs | AD CS configuration changes |
| Defender for Identity | AD CS posture assessments |
| PKI inventory reviews | Configuration drift |
Common Mistakes
Assuming Any Purpose is always required
Many organizations inherit certificate templates from older deployments that no longer reflect current operational needs.
Publishing templates that nobody uses
Unused templates increase administrative complexity and expand the attack surface.
Granting enrollment to large security groups
Broad enrollment permissions often create unnecessary exposure.
Ignoring template reviews
Certificate templates frequently remain unchanged for years while the surrounding environment evolves.
Focusing only on EKUs
ESC2 should always be evaluated alongside enrollment permissions, issuance requirements, template ownership, and authentication capabilities.
Practical Recommendation
An effective ESC2 review should include:
- Inventory every published certificate template.
- Identify templates with Any Purpose or unrestricted EKUs.
- Confirm each template has a documented business owner.
- Remove unused templates.
- Restrict enrollment permissions.
- Review issuance requirements.
- Separate templates by business function.
- Monitor certificate issuance.
- Review AD CS during regular security assessments.
Certificate templates should be intentionally designed, narrowly scoped, and regularly reviewed.
Summary
ESC2 is an Active Directory Certificate Services exposure where certificate templates allow certificates to be issued with the Any Purpose EKU or without meaningful Extended Key Usage restrictions. Although ESC2 alone does not necessarily result in compromise, it weakens an important security boundary by allowing certificates to be used more broadly than intended.
A proper ESC2 review should examine much more than EKUs. Enrollment permissions, issuance requirements, authentication capabilities, template ownership, and overall PKI design all contribute to the real level of risk. By keeping certificate templates narrowly scoped, removing unnecessary templates, and regularly reviewing AD CS configuration, organizations can reduce attack surface while maintaining a more secure and manageable public key infrastructure.