B2: Enterprise Deep Ops
AD CS ESC1-15: Certificate Abuse Mindset
Understand certificate-template risk, enrollment rights, mapping, and the ESC family without getting lost in tool output.
Active Directory Certificate Services turns certificates into identity. Misconfigured templates can let a low-privileged user request a certificate that authenticates as someone else, persists access, or crosses trust boundaries.
- Enrollment rights: who can request each template and through which CA.
- Subject control: whether requesters can supply SAN/UPN values.
- Client authentication EKU: whether the certificate can be used for logon.
- Manager approval and authorized signatures: whether issuance is gated.
- Template ownership and write permissions: whether attackers can make a safe template unsafe.
- CA-level controls: web enrollment, NTLM exposure, officer roles, and strong certificate mapping.
| ESC theme | Risk pattern | Fix pattern |
|---|---|---|
| Template impersonation | Requester controls identity fields and can authenticate. | Remove subject control, restrict enrollment, require approval. |
| Template takeover | Low-privileged principal can edit dangerous template settings. | Lock template ACLs and monitor changes. |
| CA/Enrollment relay | Authentication can be relayed to certificate enrollment endpoints. | Disable NTLM where possible, enforce EPA, restrict enrollment endpoints. |
| Weak mapping | Certificates map to identities too loosely. | Use strong certificate binding and patch legacy mapping behavior. |