Ad Cs

---
name: ad-cs
description: "Expert agent for Active Directory Certificate Services. Provides deep expertise in enterprise PKI, certificate templates, enrollment, CRL/OCSP, and ESC1-ESC16 vulnerability detection and remediation. WHEN: \"AD CS\", \"ADCS\", \"PKI\", \"certificate template\", \"auto-enrollment\", \"CRL\", \"OCSP\", \"ESC1\", \"ESC8\", \"Certify\", \"Certipy\", \"certificate authority\", \"enterprise CA\", \"certificate vulnerability\"."
license: MIT
---

# AD CS

This skill covers Active Directory Certificate Services (AD CS). It has deep knowledge of enterprise PKI architecture, certificate template security, enrollment methods, revocation mechanisms, and -- critically -- the ESC1 through ESC16 attack paths that represent some of the most exploitable vulnerabilities in enterprise environments.

## Identity and Scope

AD CS provides enterprise PKI for Windows environments:
- Certificate Authority (CA) hierarchy (root CA, subordinate CAs)
- Certificate templates and enrollment (auto-enrollment, web enrollment, CEP/CES)
- CRL and OCSP for certificate revocation
- Integration with AD DS, Kerberos (PKINIT), smart cards, TLS, code signing, EFS

## How to Approach Tasks

When you receive a request:

1. **Classify** the request:
   - **PKI architecture** -- CA hierarchy design, template planning, enrollment strategy
   - **Vulnerability assessment** -- Load `references/vulnerabilities.md` for ESC1-ESC16
   - **Troubleshooting** -- Certificate enrollment failures, revocation issues, chain building
   - **Operations** -- CA maintenance, certificate renewal, CRL management
   - **Hardening** -- Template permissions, CA security, audit logging

2. **Assess vulnerability exposure** -- For any AD CS question, consider whether the configuration introduces ESC vulnerability paths. This is not optional -- AD CS misconfigurations are among the most exploited in enterprise environments.

3. **Load context** -- Read `references/vulnerabilities.md` for deep ESC attack path knowledge.

4. **Analyze** -- Apply PKI-specific reasoning. Consider certificate chain trust, template permissions, enrollment permissions, and protocol-level attack vectors.

5. **Recommend** -- Provide actionable guidance with remediation steps and PowerShell examples.

## Core Expertise

### CA Architecture

**Recommended hierarchy:**

```
Offline Root CA (standalone, air-gapped)
  |-- Issuing CA 1 (enterprise, AD-integrated, online)
  |-- Issuing CA 2 (enterprise, AD-integrated, online)
```

- **Root CA** -- Offline, standalone (not domain-joined). Issues only subordinate CA certificates. Physically secured. CRL published manually.
- **Issuing CA (Subordinate)** -- Enterprise CA, domain-joined, AD-integrated. Issues end-entity certificates. Online for enrollment.
- **Never use a root CA as an issuing CA** in production. Single-tier PKI is acceptable only for lab/test environments.

### Certificate Templates

Templates define the properties and permissions for certificates issued by an enterprise CA:

```powershell
# List all published certificate templates
certutil -v -template

# List templates published on a CA
certutil -CATemplates

# View template security (permissions)
# Use PKIVIEW.msc, certtmpl.msc, or:
Get-ADObject -LDAPFilter "(objectClass=pKICertificateTemplate)" -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=example,DC=com" -Properties * |
    Select-Object Name, msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, nTSecurityDescriptor
```

**Critical template settings:**

| Setting | Secure Configuration | Risk if Misconfigured |
|---|---|---|
| **Subject Name** | "Supply in the request" DISABLED (build from AD) | ESC1 -- Attacker specifies any SAN/UPN |
| **Enrollment Permissions** | Restricted to specific groups | Broad enrollment enables exploitation |
| **EKU (Extended Key Usage)** | Specific EKU (Client Auth, Server Auth) | Any Purpose or no EKU = impersonation risk |
| **Manager Approval** | Required for sensitive templates | Unapproved enrollment if disabled |
| **Authorized Signatures** | Required for sensitive templates | Enrollment without CSR co-signing |

### Enrollment Methods

| Method | Use Case | Security Considerations |
|---|---|---|
| **Auto-enrollment** | Domain-joined computers and users | GPO-driven, most common, ensure template permissions are tight |
| **Manual enrollment (MMC)** | Administrator-initiated | Direct CA access required |
| **Web enrollment (certsrv)** | Browser-based enrollment | NTLM relay risk (ESC8) if HTTP, must use HTTPS |
| **CEP/CES** | Cross-forest, DMZ, non-domain-joined | Certificate Enrollment Policy/Service endpoints |
| **NDES (SCEP)** | Network devices (routers, switches, BYOD) | Challenge password management critical |

### Certificate Revocation

| Mechanism | Freshness | Deployment | Considerations |
|---|---|---|---|
| **CRL (Certificate Revocation List)** | Periodic (hours/days) | CDP extension in certificates | Must be accessible to all reliant parties. Publish to HTTP and LDAP. |
| **Delta CRL** | More frequent | Supplements base CRL | Reduces CRL download size between base CRL publications |
| **OCSP** | Real-time | Online Responder role | Preferred for real-time revocation checking. Requires Online Responder. |

```powershell
# Check CRL publication
certutil -verify -urlfetch <certificate.cer>

# Publish CRL manually
certutil -CRL

# Check Online Responder health
Get-OCSPRevocationConfiguration
```

### Key Event IDs

| Event ID | Source | Description |
|---|---|---|
| 4886 | Security | Certificate request received |
| 4887 | Security | Certificate request approved and issued |
| 4888 | Security | Certificate request denied |
| 4890 | Security | Certificate manager settings changed |
| 4896 | Security | Certificate template deleted |
| 4898 | Security | Certificate Services loaded a template |
| 4899 | Security | Certificate template updated |

### AD CS Hardening Checklist

1. **Audit all certificate templates** -- Enumerate with Certify, Certipy, or PSPKIAudit. Fix ESC1-ESC16 findings.
2. **Restrict enrollment permissions** -- No "Authenticated Users" or "Domain Computers" on sensitive templates.
3. **Disable "Supply in the request"** -- Unless explicitly required and additionally protected by manager approval.
4. **Enable manager approval** -- For templates that allow SANs or have broad enrollment.
5. **Require authorized signatures** -- For sensitive templates (code signing, smart card).
6. **Secure web enrollment** -- HTTPS only. Disable HTTP enrollment endpoints. Enable Extended Protection for Authentication (EPA).
7. **CA server hardening** -- Treat as Tier 0. No internet access. Minimal roles installed. Credential Guard enabled.
8. **Enable auditing** -- Object access auditing on CA, certificate request auditing.
9. **Monitor for Certify/Certipy** -- Alert on Event 4886/4887 for suspicious template enrollments.
10. **Disable unnecessary templates** -- Unpublish templates that are not actively used.

### Common Troubleshooting

| Issue | Investigation | Resolution |
|---|---|---|
| Auto-enrollment not working | `certutil -pulse`, check GP application, Event 13/64 in CertificateServicesClient | Verify template permissions, CA accessibility, GP settings |
| Certificate chain build failure | `certutil -verify -urlfetch cert.cer` | Publish root/intermediate CA certs to NTAuth store, check AIA extension |
| CRL download failure | `certutil -URL cert.cer` (URL Retrieval Tool) | Fix CDP paths, verify HTTP/LDAP accessibility |
| Template not appearing in enrollment | Check published templates on CA, enrollment permissions | Publish template, grant Enroll permission |
| OCSP responder failure | Online Responder console, Event Viewer | Signing certificate expired, revocation config issue |

## ESC Vulnerability Overview

AD CS attack paths (ESC1-ESC16) are critical vulnerabilities. For the full reference with detection and remediation for each, load `references/vulnerabilities.md`.

**High-level summary:**

| ESC | Name | Severity | Key Issue |
|---|---|---|---|
| ESC1 | Misconfigured Certificate Templates | Critical | Attacker specifies SAN, enrolls as any user |
| ESC2 | Misconfigured Certificate Templates (Any Purpose) | Critical | Certificate with Any Purpose EKU |
| ESC3 | Enrollment Agent Misuse | High | Enrollment agent enrolls on behalf of others |
| ESC4 | Vulnerable Certificate Template ACLs | Critical | Attacker modifies template to create ESC1 |
| ESC5 | Vulnerable PKI Object ACLs | High | Attacker modifies CA or PKI AD objects |
| ESC6 | EDITF_ATTRIBUTESUBJECTALTNAME2 | Critical | CA allows SAN in any request |
| ESC7 | Vulnerable CA ACLs | Critical | Attacker manages CA, approves requests |
| ESC8 | NTLM Relay to Web Enrollment | Critical | Relay machine account NTLM to HTTP enrollment |
| ESC9 | CT_FLAG_NO_SECURITY_EXTENSION | High | Certificate missing security extension |
| ESC10 | Weak Certificate Mapping | High | Weak mapping allows impersonation |
| ESC11 | NTLM Relay to ICPR (RPC) | High | Relay to CA RPC interface |
| ESC12 | CA with YubiHSM | Medium | Plaintext key in registry |
| ESC13 | Issuance Policy OID Abuse | High | Group mapping via OID links |
| ESC14 | Weak Explicit Certificate Mapping | High | Alteration of mapped attributes |
| ESC15 | Application Policy Schemas v1 | Medium | Schema v1 EKU interpretation issues |
| ESC16 | Similar to ESC15 for other schemas | Medium | Extended schema issues |

**Detection tools:**
- **Certify** (C#) -- `Certify.exe find /vulnerable`
- **Certipy** (Python) -- `certipy find -u user@domain -p pass -dc-ip 10.0.0.1 -vulnerable`
- **PSPKIAudit** (PowerShell) -- Audit PKI configuration
- **Locksmith** (PowerShell) -- Comprehensive AD CS auditing

## Reference Files

Load these for deep ESC vulnerability knowledge:
- `references/vulnerabilities.md` -- Complete ESC1-ESC16 attack path documentation: exploitation methods, detection via event logs and tooling, and step-by-step remediation for each vulnerability class.