AD CS Security Checklist

Active Directory Certificate Services Security Checklist

A practical checklist for reviewing Active Directory Certificate Services risk, certificate template exposure, enrollment controls, and common privilege escalation paths.

Active Directory Certificate Services can become one of the most powerful systems in an Active Directory environment. Misconfigured certificate templates, weak enrollment permissions, insecure web enrollment, or poor CA administration can create paths to impersonation, persistence, and domain compromise.

View Checklist Print Checklist
01

Inventory the PKI

Identify enterprise CAs, templates, enrollment endpoints, issuing CAs, root CAs, and certificate-dependent services.

02

Review Templates

Focus on templates that allow authentication, broad enrollment, subject supply, weak approvals, or dangerous permissions.

03

Harden Enrollment

Reduce NTLM relay exposure, secure web enrollment, review RPC enrollment, and enforce appropriate approval controls.

04

Monitor Changes

Track changes to templates, CA configuration, CA permissions, enrollment activity, and certificate mapping behavior.

Critical Priority

PKI Inventory

Start by identifying what exists. Many AD CS risks are missed because certificate authorities, templates, and enrollment endpoints are not fully inventoried.

  • Identify all enterprise certificate authorities in the forest.
  • Identify all root CAs, issuing CAs, subordinate CAs, and offline CAs.
  • Document which CAs are actively issuing certificates.
  • Review which certificate templates are published to each issuing CA.
  • Identify AD CS web enrollment, certificate enrollment web service, and certificate enrollment policy web service endpoints.
  • Identify systems and applications that depend on certificates for authentication, encryption, signing, VPN, Wi-Fi, smart card, or device identity.
  • Review certificate authorities that are no longer used but still trusted.
  • Identify certificates issued for domain controllers, users, computers, service accounts, and administrative systems.
  • Document PKI owners, operational contacts, and change approval responsibilities.
  • Confirm that PKI systems are treated as Tier 0 or equivalent identity infrastructure where appropriate.
Critical Priority

Certificate Authority Hardening

Certificate authorities can issue credentials that may be trusted for authentication. Protect CA servers and CA administration as high-value identity infrastructure.

  • Limit local administrator access on CA servers to authorized PKI administrators.
  • Restrict interactive logon to CA servers.
  • Keep CA servers fully patched and running supported operating systems.
  • Remove unnecessary roles, services, and software from CA servers.
  • Restrict internet browsing and general-purpose use from CA servers.
  • Protect CA private keys using appropriate operating system, HSM, or key protection controls.
  • Review CA permissions, including Manage CA, Issue and Manage Certificates, and request certificate permissions.
  • Review who can modify CA configuration and CA security settings.
  • Ensure CA backups are protected from unauthorized access.
  • Monitor administrative activity on CA servers.
Critical Priority

Certificate Template Security

Certificate templates define what certificates can be issued, who can request them, and how certificate subjects and uses are controlled.

  • Inventory all enabled certificate templates.
  • Identify templates published to issuing CAs.
  • Review templates that allow client authentication, smart card logon, PKINIT, or other authentication-related EKUs.
  • Identify templates where the enrollee can supply subject information.
  • Identify templates where the enrollee can supply Subject Alternative Name values.
  • Review templates with Any Purpose or no EKU restrictions.
  • Review templates with certificate request agent or enrollment agent usage.
  • Review templates that allow private key export.
  • Review templates with long certificate validity periods.
  • Remove or disable templates that are no longer required.
Critical Priority

Enrollment Permissions

Template permissions determine who can request certificates. Broad enrollment rights on powerful templates are one of the most common AD CS security problems.

  • Review which users, groups, computers, and service accounts have Enroll permission on each template.
  • Review which principals have Autoenroll permission.
  • Remove broad enrollment rights such as Domain Users, Authenticated Users, or Domain Computers from high-impact templates unless explicitly required.
  • Ensure authentication-capable templates are restricted to appropriate users or systems.
  • Review template ACLs for unexpected Write, WriteDacl, WriteOwner, GenericWrite, or GenericAll permissions.
  • Restrict who can modify certificate template settings.
  • Restrict who can publish templates to CAs.
  • Require manager approval or authorized signatures where appropriate for sensitive templates.
  • Review whether enrollment permissions match the intended business purpose of the template.
  • Document template ownership and approval requirements.
Critical Priority

Authentication-Capable Templates

Templates that can issue certificates usable for authentication require special review because they may allow users or machines to authenticate as certificate subjects.

  • Identify templates containing Client Authentication EKU.
  • Identify templates containing Smart Card Logon EKU.
  • Identify templates containing PKINIT Client Authentication or similar authentication-capable EKUs.
  • Review templates with Any Purpose EKU.
  • Review templates with no EKU restrictions where authentication may still be possible.
  • Ensure authentication-capable templates do not allow low-privilege users to supply arbitrary subject or SAN values.
  • Review whether authentication-capable templates require approval or authorized signatures.
  • Review whether issued certificates can be used for long periods without revalidation.
  • Remove unnecessary authentication EKUs from templates that do not require them.
  • Monitor enrollment activity for authentication-capable templates.
Critical Priority

ESC Risk Review

Common AD CS escalation paths are often grouped as ESC findings. These paths usually involve dangerous combinations of template settings, enrollment permissions, CA permissions, or enrollment endpoints.

  • Review templates where low-privilege users can enroll and supply subject or SAN values.
  • Review templates with authentication EKUs and broad enrollment permissions.
  • Review enrollment agent templates and who can request them.
  • Review certificate templates with weak ACLs that allow unauthorized modification.
  • Review CA permissions that allow non-PKI administrators to manage the CA or issue certificates.
  • Review CA configurations that allow dangerous request attributes.
  • Review who can manage certificate templates in Active Directory.
  • Review AD CS web enrollment endpoints for NTLM relay exposure.
  • Review certificate mapping settings and weak mapping risks.
  • Prioritize remediation for any path that allows certificate-based authentication as another user, computer, or privileged identity.
Critical Priority

Web Enrollment and Relay Protection

AD CS web enrollment endpoints can become high-impact NTLM relay targets if they accept Windows authentication without sufficient protections.

  • Identify whether Certificate Authority Web Enrollment is installed.
  • Identify whether Certificate Enrollment Web Service is installed.
  • Identify whether Certificate Enrollment Policy Web Service is installed.
  • Remove web enrollment services if they are not required.
  • Require HTTPS for web enrollment endpoints.
  • Enable Extended Protection for Authentication where appropriate.
  • Disable NTLM for IIS on AD CS enrollment endpoints where feasible.
  • Restrict access to enrollment endpoints to required systems and users.
  • Review IIS authentication providers and avoid unnecessary Windows authentication exposure.
  • Monitor enrollment activity and IIS logs for unusual certificate requests.
High Priority

Certificate Mapping and Authentication

Certificate mapping controls affect how certificates are associated with Active Directory identities. Weak mappings can create impersonation risk.

  • Review certificate-based authentication dependencies before changing mapping behavior.
  • Review domain controller patch levels related to certificate-based authentication changes.
  • Review weak or legacy certificate mappings.
  • Review accounts with explicit certificate mappings in attributes such as altSecurityIdentities.
  • Remove stale or unnecessary certificate mappings.
  • Validate that certificates used for authentication map to the intended identity.
  • Review certificate templates that allow subject or SAN values to be supplied by the requester.
  • Monitor changes to certificate mapping attributes.
  • Document legitimate certificate mapping exceptions.
  • Test certificate-based authentication behavior after template or domain controller changes.
High Priority

Private Keys and Certificate Handling

Certificates are only as strong as the private keys behind them. Exportable, poorly protected, or broadly distributed private keys can create long-lasting access paths.

  • Review templates that allow private keys to be exported.
  • Disable private key export unless there is a documented business requirement.
  • Protect CA private keys with strong access controls.
  • Review who can back up or export CA keys.
  • Review whether certificates are stored on shared systems, file shares, scripts, or deployment repositories.
  • Ensure service certificates are distributed through controlled processes.
  • Review certificate renewal workflows for key reuse and key protection.
  • Use strong key lengths and modern cryptographic settings where supported.
  • Review expired certificates that may still have private keys present on systems.
  • Document certificate owners and renewal responsibilities.
High Priority

Auditing and Monitoring

AD CS changes should be monitored because a single template or CA configuration change can create a powerful escalation path.

  • Enable and review CA auditing settings.
  • Monitor certificate issuance for authentication-capable templates.
  • Monitor failed and denied certificate requests.
  • Monitor certificate template changes.
  • Monitor CA configuration changes.
  • Monitor changes to CA permissions and template permissions.
  • Monitor changes to enrollment agent templates and permissions.
  • Monitor changes to certificate mapping attributes.
  • Monitor IIS logs for AD CS web enrollment endpoints.
  • Review certificate enrollment activity from unusual accounts, systems, or source addresses.
Medium Priority

Operations and Lifecycle

PKI security depends on long-term maintenance. Templates, CAs, issued certificates, and trust relationships should be reviewed regularly.

  • Assign clear ownership for each CA and certificate template.
  • Review templates on a recurring schedule.
  • Remove unused templates from issuing CAs.
  • Retire unused or unnecessary CAs through a controlled process.
  • Review certificate validity periods and renewal periods.
  • Review certificate revocation list availability and publishing configuration.
  • Validate that CRL and AIA locations remain reachable.
  • Maintain CA backup and recovery procedures.
  • Test CA recovery in a safe environment.
  • Document approved exceptions and review them periodically.

Use Carefully

Validate AD CS changes before applying them broadly.

AD CS is often tied to authentication, device trust, VPN, Wi-Fi, smart cards, application identity, and internal encryption. Review dependencies, test changes safely, and document exceptions before modifying certificate templates, CA settings, enrollment endpoints, or certificate mapping behavior in production.

References

Reference material

Scroll to Top