Active Directory Certificate Services (AD CS) Security: Auditing Misconfigurations, ESC1/ESC8 Hardening & KQL Detection (2026 Masterclass)

BLUF — Bottom Line Up Front

Active Directory Certificate Services (AD CS) is Microsoft’s built-in Public Key Infrastructure (PKI) implementation. It issues X.509 certificates used for user authentication, VPN access, code signing, and SSL/TLS encryption.

When AD CS certificate templates or HTTP enrollment interfaces are misconfigured, low-privileged attackers can abuse Kerberos PKINIT authentication to request certificates for high-privilege identities (such as Domain Administrators) or relay authentication to HTTP endpoints to compromise Domain Controllers.

• Core Vulnerabilities: Permissive Subject Alternative Name (SAN) definitions (ESC1) and unauthenticated NTLM relaying to HTTP Web Enrollment /certsrv (ESC8).
• Impact: Instant Active Directory Domain Escalation → Full Forest Compromise.
• Defensive Mitigations: Disabling ENROLLEE_SUPPLIES_SUBJECT flags, restricting template ACLs, enforcing Extended Protection for Authentication (EPA) + HTTPS, enforcing KB5014754 strong certificate mapping, and deploying KQL detection rules for Event ID 4887.

Step 0: Intuition & Mental Model (First Principles)

To understand AD CS security, we must build a clear mental model of how digital certificates function as enterprise passports.

The "Passport Office" Analogy

Imagine a government passport office operating inside a secure facility:

1. The Certification Authority (CA): Acts as the passport office. It verifies applicant identity and signs valid passports.
2. The Certificate Template: The application form detailing rules for obtaining a passport (e.g. who is allowed to apply, what information goes on the passport, and how long it remains valid).
3. The Subject Alternative Name (SAN): The official full name printed on the passport photo page.
4. PKINIT Kerberos Authentication: The border control officer who inspects the passport. When presented with a valid passport signed by the CA, the officer lets the holder through without asking for a password.

Where the System Breaks (ESC1 & ESC8)

• ESC1 (Blank Passport Fraud): The passport application form (Template) includes an unchecked box allowing the applicant to handwrite any name they want on their own passport. A low-level employee fills out the form, writes "President of the Country" in the name box, and the CA signs it. Presenting this passport grants President-level access.
• ESC8 (Credential Interception): The passport office accepts application forms sent via an unencrypted, unauthenticated mailbox on the street corner (HTTP Web Enrollment). An attacker intercepts someone else's mail (NTLM relay) and submits it to get a passport issued in the victim's name.

Step 1: Under-the-Hood Architecture & Protocol Mechanics

AD CS relies on Active Directory LDAP objects stored in the Configuration Partition (CN=Configuration,DC=domain,DC=com).

  [ Client Request ] 
          |
          v
  +--------------------------------------------------------+
  | AD CS Certification Authority (CA)                     |
  | Reads Template: CN=Certificate Templates,CN=Public Key |
  +--------------------------------------------------------+
          |
          +---> Checks msPKI-Certificate-Name-Flag
          |     (Flag 0x00010000 = CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT)
          |
          +---> Checks pKIExtendedKeyUsage
          |     (1.3.6.1.5.5.7.3.2 = Client Authentication / Smart Card Logon)
          |
          v
  [ Issued X.509 Certificate with Custom UPN ]
          |
          v
  [ Presented to KDC via Kerberos PKINIT (RFC 4556) ] ---> Returns TGT for Target UPN

Key LDAP Template Attributes Matrix

Step 2: Theoretical Audit & Inspection Methodology

Security auditors evaluate AD CS posture by inspecting Active Directory LDAP attributes using PowerShell, LDAP queries, or native administrative tools.

Querying Vulnerable Templates via PowerShell (Active Directory Module)

# Querying LDAP Configuration Partition for permissive SAN templates
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=corp,DC=local" `
    -Filter {msPKI-Certificate-Name-Flag -band 0x00010000} `
    -Properties DisplayName, pKIExtendedKeyUsage, msPKI-Certificate-Name-Flag |
    Select-Object DisplayName, pKIExtendedKeyUsage

Line-by-Line Script Breakdown

• -SearchBase "CN=Certificate Templates...": Targets the LDAP partition where AD CS template objects are stored across the forest.
• -Filter {msPKI-Certificate-Name-Flag -band 0x00010000}: Performs a bitwise AND operation to find templates where the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT bit is set.
• Select-Object DisplayName, pKIExtendedKeyUsage: Displays the template name alongside its Extended Key Usage flags (checking for Client Auth).

Step 3: Defensive Remediation & Hardening Roadmap

1. Hardening Certificate Templates (Fixing ESC1)

1. Open certtmpl.msc (Certificate Templates MMC snap-in) on the CA.
2. Locate vulnerable templates and open Properties.
3. Under the Subject Name tab, select "Build from this Active Directory information" instead of "Supply in the request".
4. Under the Security tab, review the Access Control List (ACL). Remove Domain Users and Authenticated Users from Enroll permissions.
5. Require Issuance Approval under the Issuance Requirements tab for high-privilege templates.

2. Securing Web Enrollment Endpoints (Fixing ESC8)

1. Remove Unused Role Services: If HTTP Web Enrollment (/certsrv) is not required, uninstall the role service from the Server Manager.
2. Enforce HTTPS & EPA: If Web Enrollment is required:
   • Configure IIS to reject plain HTTP traffic and mandate SSL/TLS (HTTPS).
   • Enable Extended Protection for Authentication (EPA) in IIS under Authentication -> Windows Authentication -> Advanced Settings -> set to Required.
3. Disable NTLM Authentication: Restrict IIS authentication to Kerberos-only or disable NTLM across web enrollment virtual directories.

3. Deploying Strong Certificate Binding (KB5014754)

Microsoft update KB5014754 enforces explicit mapping between X.509 certificates and Active Directory user accounts.

# Registry key to set Strong Certificate Binding Enforcement Mode (Mode 2)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc]
"StrongCertificateBindingEnforcement"=dword:00000002

Step 4: Detection Engineering & Monitoring (KQL Rules)

When Certificate Services auditing is enabled (auditpol /set /subcategory:"Certification Services" /success:enable), the CA generates Event ID 4887 for every issued certificate.

KQL Rule 1: Detecting SAN Mismatches (ESC1 Indicator)

// Detects certificate issuance where the requester's account differs from the Subject/SAN identity
SecurityEvent
| where EventID == 4887
| extend RequesterName = tostring(EventData.RequesterName),
         SubjectUserName = tostring(EventData.SubjectUserName),
         TemplateName = tostring(EventData.TemplateName),
         ClientIP = tostring(EventData.ClientAddress)
| where RequesterName !contains SubjectUserName
| where SubjectUserName contains "Admin" or SubjectUserName contains "DA" or SubjectUserName contains "svc"
| project TimeGenerated, RequesterName, SubjectUserName, TemplateName, ClientIP

KQL Rule 2: Machine Accounts Requesting User Authentication Templates (ESC8 Indicator)

// Detects computer accounts (ending in $) requesting user-type authentication templates
SecurityEvent
| where EventID == 4887
| extend RequesterName = tostring(EventData.RequesterName),
         TemplateName = tostring(EventData.TemplateName),
         ClientIP = tostring(EventData.ClientAddress)
| where RequesterName endswith "$"
| where TemplateName !in ("Machine", "DomainController", "DomainControllerAuthentication", "Computer")
| project TimeGenerated, RequesterName, TemplateName, ClientIP

Summary & Key Takeaways

1. Intuition First: AD CS misconfigurations turn digital certificates into forgeable identity passports.
2. ESC1 Risk: Enrollee-supplied SANs (0x00010000) combined with Client Authentication EKUs allow low-privileged users to request certificates for administrative accounts.
3. ESC8 Risk: HTTP Web Enrollment endpoints without EPA allow attackers to relay NTLM authentication to harvest computer/DC certificates.
4. Defense in Depth: Enforce AD-built subject names, restrict template ACLs, enable EPA + HTTPS on IIS, enforce KB5014754 strong binding, and monitor Event ID 4887.

Authored by Syed Zada Abrar — Founder & Lead Researcher, Andrax Pentester.