AD CS Certificate Templates Explained: V1-V4, Configuration & Security Hardening

Auto-Enrollment Configuration

Auto-enrollment is AD CS’s most powerful feature — certificates are issued and renewed without user or admin intervention.

Requirements for Auto-Enrollment

1. Template has Autoenroll permission for the target group
2. Template has Enroll permission for the same group
3. Template is published on the issuing CA
4. GPO enables auto-enrollment for the target OU
5. Subject is built from AD (not “Supply in request”)

GPO Settings

Computer Configuration → Policies → Windows Settings → Security Settings →
  Public Key Policies → Certificate Services Client - Auto-Enrollment

Settings:
  Configuration Model: Enabled
  ☑ Renew expired certificates, update pending certificates, remove revoked certificates
  ☑ Update certificates that use certificate templates

Verifying Auto-Enrollment

# Force auto-enrollment
certutil -pulse

# Check what templates are available for auto-enrollment
certutil -CATemplates | findstr "Autoenroll"

# View enrolled certificates
certutil -store My

# Check auto-enrollment events
Get-WinEvent -LogName "Application" -FilterXPath "*[System[Provider[@Name='Microsoft-Windows-CertificateServicesClient-AutoEnrollment']]]" |
  Select-Object -First 10 TimeCreated, Id, Message

ESC Vulnerabilities: Template Misconfigurations Attackers Exploit

The “Certified Pre-Owned” research (Schroeder & Christensen, 2021) identified multiple AD CS escalation paths. Most involve template misconfigurations:

ESC1: Requestor Can Specify SAN + Low-Privilege Enrollment

The most dangerous misconfiguration. A template that allows:

1. “Supply in request” for subject name (CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT)
2. Client Authentication or Any Purpose EKU
3. Enroll permission for low-privilege users (Domain Users, Authenticated Users)

Attack: Any domain user requests a certificate with SAN=administrator@contoso.com, then uses it to authenticate as Domain Admin.

Detection:

# Find ESC1-vulnerable templates
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=com" `
  -Filter * -Properties msPKI-Certificate-Name-Flag, pKIExtendedKeyUsage, nTSecurityDescriptor |
  Where-Object {
    # CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT = 1
    ($_.'msPKI-Certificate-Name-Flag' -band 1) -and
    # Has Client Auth or Any Purpose EKU
    ($_.pKIExtendedKeyUsage -contains '1.3.6.1.5.5.7.3.2' -or
     $_.pKIExtendedKeyUsage -contains '2.5.29.37.0' -or
     $_.pKIExtendedKeyUsage.Count -eq 0)
  } | Select-Object Name

Fix: Remove “Supply in request” OR restrict enrollment to PKI admins only OR remove Client Authentication EKU.

ESC2: Any Purpose EKU or No EKU

Templates with “Any Purpose” EKU or no EKU at all can be used for any operation — including client authentication for privilege escalation.

Fix: Always specify explicit EKUs. Never leave EKU empty or set to “Any Purpose.”

ESC3: Certificate Request Agent

The “Certificate Request Agent” template allows a user to enroll on behalf of others. If low-privilege users can enroll in this template, they can request certificates as any user.

Fix: Restrict “Certificate Request Agent” enrollment to CA administrators only.

ESC4: Template ACL Allows Modification

If low-privilege users have Write or Full Control on a template, they can modify it to become ESC1-vulnerable.

Detection:

# Check who can modify templates
Get-ADObject -SearchBase "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,DC=contoso,DC=com" `
  -Filter * -Properties nTSecurityDescriptor |
  ForEach-Object {
    $template = $_.Name
    $_.nTSecurityDescriptor.Access |
      Where-Object { $_.ActiveDirectoryRights -match "WriteProperty|WriteDacl|WriteOwner|GenericAll|GenericWrite" -and
                     $_.IdentityReference -notmatch "Domain Admins|Enterprise Admins|SYSTEM" } |
      ForEach-Object { [PSCustomObject]@{ Template=$template; Principal=$_.IdentityReference; Rights=$_.ActiveDirectoryRights } }
  }

Fix: Remove Write permissions from non-admin groups on all templates.

ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 Flag

If this flag is enabled on the CA, ANY template becomes ESC1-vulnerable — requestors can specify SANs regardless of template settings.

Detection and Fix:

# Check if the dangerous flag is set
certutil -getreg policy\EditFlags
# Look for: EDITF_ATTRIBUTESUBJECTALTNAME2

# Disable it
certutil -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2
Restart-Service certsvc

ESC8: HTTP Enrollment Without HTTPS

Web Enrollment, CEP, or CES endpoints accessible over HTTP (not HTTPS) allow NTLM relay attacks to request certificates as the relayed user.

Fix: Enforce HTTPS on all enrollment endpoints. Disable HTTP bindings.

Template Security Audit Script

# ad-cs-template-audit.ps1 — Comprehensive template security check

$templateBase = "CN=Certificate Templates,CN=Public Key Services,CN=Services,CN=Configuration,$((Get-ADDomain).DistinguishedName)"

$templates = Get-ADObject -SearchBase $templateBase -Filter * -Properties *

foreach ($t in $templates) {
    $issues = @()

    # ESC1: Supply in request + Client Auth + broad enrollment
    if ($t.'msPKI-Certificate-Name-Flag' -band 1) {
        $enrollers = $t.nTSecurityDescriptor.Access |
          Where-Object { $_.ActiveDirectoryRights -match "ExtendedRight" -and $_.ObjectType -eq "0e10c968-78fb-11d2-90d4-00c04f79dc55" }
        if ($enrollers.IdentityReference -match "Authenticated Users|Domain Users|Domain Computers") {
            $issues += "ESC1: Supply-in-request + broad enrollment"
        }
    }

    # ESC2: Any Purpose or no EKU
    if ($t.pKIExtendedKeyUsage -contains '2.5.29.37.0' -or $t.pKIExtendedKeyUsage.Count -eq 0) {
        $issues += "ESC2: Any Purpose or empty EKU"
    }

    # ESC4: Writable by non-admins
    $writers = $t.nTSecurityDescriptor.Access |
      Where-Object { $_.ActiveDirectoryRights -match "WriteProperty|WriteDacl|GenericAll|GenericWrite" -and
                     $_.IdentityReference -notmatch "Domain Admins|Enterprise Admins|SYSTEM|Cert Publishers" }
    if ($writers) {
        $issues += "ESC4: Writable by $($writers.IdentityReference -join ', ')"
    }

    if ($issues.Count -gt 0) {
        Write-Warning "Template: $($t.Name)"
        $issues | ForEach-Object { Write-Warning "  - $_" }
    }
}

# ESC6: Check CA-level flag
$editFlags = certutil -getreg policy\EditFlags 2>$null
if ($editFlags -match "EDITF_ATTRIBUTESUBJECTALTNAME2") {
    Write-Warning "ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2 is ENABLED on the CA!"
}

Recommended Template Set for Enterprise