Back to Home

AD CS Attacks

Active Directory Certificate Services is Microsoft's PKI implementation. Widely deployed, rarely secured, and catastrophically misconfigurable. The 2021 "Certified Pre-Owned" research revealed attack paths that allow domain compromise from a single misconfigured template.

Heavy Elements: The Attacks That Matter Most

These five vulnerabilities represent the most commonly exploited, highest-impact attack paths. If you only have time to check a few things, check these first.

ESC1 Enrollee Supplies Subject
CRITICAL TEMPLATE
📖 What's happening here?
Certificate templates are like forms that define what kind of certificate you get. One setting called "Supply in the request" lets you write in who the certificate is for. If this is enabled on a template that can be used for login, you can request a certificate that says you're a Domain Admin, even if you're not.
ESC1 Attack Flow
👤
Attacker
Low-priv user
Request cert
"I'm admin"
🏛️
CA Server
"OK, here you go"
Login with
admin cert
💀
Domain Admin
🔧 Fix (in order of priority):

1. Quick win: Remove enrollment rights from "Authenticated Users" or "Domain Users" on vulnerable templates. Takes 2 minutes, breaks nothing if template isn't widely used.

2. Proper fix: Uncheck "Supply in the request" on any template that allows login (has Client Authentication EKU). Use "Build from Active Directory" instead.

⚠️ What might break?
"Supply in the request" is legitimately used for web server certificates where you need to specify the server name, but only when enrollment is restricted to privileged groups (e.g., server admins). If users request SSL certs via the web interface, they may need to use a different method (MMC snap-in, certreq command line, or autoenrollment). Authentication templates (User, Workstation, Computer) should NEVER have this setting.
ESC8 NTLM Relay to Web Enrollment
CRITICAL RELAY
📖 What's happening here?
AD CS has a website (usually at http://yourca/certsrv/) where users can request certificates through their browser. This is called "Web Enrollment." The problem: this website accepts NTLM authentication, which can be relayed. Attackers trick a Domain Controller into authenticating to them, then forward that authentication to the CA website to get a certificate as the DC.
🤔 Do we actually need web enrollment?
Probably not. Most organizations don't need it. Certificates can be requested via:
Autoenrollment (GPO-based, automatic, most common)
MMC Certificates snap-in (manual, for admins)
certreq.exe (command line)

Web enrollment is typically only needed if: (1) non-domain-joined devices need certificates (e.g., printers, appliances, DMZ servers), or (2) you have a specific legacy application that requires it. Ask your PKI team if anyone actually uses the web interface before disabling it. If you disable it, ensure those devices have an alternative enrollment path.
ESC8 Attack Flow
👤
Attacker
Network access
Trick DC
to connect
🖥️
DC
Authenticates
Forward to
/certsrv/
🏛️
CA Web
Issues cert
Cert as DC$
💀
DCSync
🔧 Fix (in order of priority):

1. Best option: Disable web enrollment entirely if no one uses it. IIS Manager → Stop the site, or uninstall the role.

2. If you need web enrollment: Enable HTTPS + Extended Protection for Authentication (EPA). Important: EPA requires HTTPS to be enabled first—enabling EPA without configuring SSL will silently break web enrollment.

3. Long-term: Disable NTLM entirely to the CA (requires Kerberos, won't work for non-domain machines).

📖 Microsoft KB5005413: Mitigating NTLM Relay on AD CS
⚠️ What might break?
Disabling web enrollment: Anyone requesting certs via browser will need to use MMC or autoenrollment instead. This is usually fine.

Enabling EPA: Older browsers/clients may not support it. Test first. Some legacy enrollment tools may fail.

Disabling NTLM: Non-domain-joined machines can't authenticate via Kerberos, so they won't be able to use web enrollment at all.
ESC6 EDITF_ATTRIBUTESUBJECTALTNAME2
CRITICAL CA CONFIG
📖 What's happening here?
This is a CA-wide flag that, when enabled, lets ANYONE specify who a certificate is for in ANY request, regardless of template settings. It's like ESC1, but worse because it affects every single template. Admins sometimes enable this because they read a blog post saying it would fix their web server certificate issues. It does fix that, but it also breaks all security.
ESC6 Attack Flow
👤
Attacker
Any template
Add SAN
to request
🏛️
CA Server
Flag enabled
Accepts any
identity
💀
Impersonate
Anyone
# Check if the flag is enabled (run on CA or with RSAT)
certutil -config "CA-Server\CA-Name" -getreg policy\EditFlags

# If EDITF_ATTRIBUTESUBJECTALTNAME2 appears in output, disable it:
certutil -config "CA-Server\CA-Name" -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2
net stop certsvc && net start certsvc
🔧 Fix:

Just disable it. One command, restart CA service, done. There's almost never a legitimate reason to have this enabled.

⚠️ What might break?
Probably nothing. This flag is almost always enabled by mistake. The proper way to allow SAN specification for web server certs is to enable "Supply in the request" on specific templates, NOT this global CA flag. If someone complains, help them configure the template correctly instead.
Note: After the May 2022 KB5014754 patch, ESC6 alone no longer enables direct impersonation because the CA now embeds the requester's actual SID in the certificate. However, ESC6 combined with ESC9 or ESC16 (no SID extension) can still be exploited.
ESC4 Template ACL Abuse
HIGH ACL
📖 What's happening here?
Certificate templates are objects in Active Directory with permissions (ACLs). If non-admin users have write access to a template, they can modify it to enable "Supply in the request" and turn it into an ESC1 vulnerability. We've seen environments where "Domain Computers" had full control over templates.
ESC4 Attack Flow
🖥️
Compromised
Machine acct
Modify
template
📄
Template
Enable SAN
Now it's
ESC1
💀
Exploit
🔧 Fix:

Audit template ACLs. Only Enterprise Admins, Domain Admins, and CA administrators should have write access. Remove write permissions for Domain Computers, Authenticated Users, Domain Users, etc. Important: Check for inherited ACLs from parent containers—GenericWrite via inheritance is a common oversight.

⚠️ What might break?
Nothing. There's no legitimate reason for non-admin accounts to modify certificate templates. This is pure permissions cleanup.
ESC7 CA Permission Abuse
CRITICAL ACL
📖 What's happening here?
The CA itself has permissions that control who can manage it. Two are dangerous:

ManageCA: Can change CA settings, including enabling ESC6. This is basically full control of the CA.

ManageCertificates: Can approve pending certificate requests. If a template requires manager approval, this bypasses it.
ESC7 Attack Flow (ManageCA)
👤
Attacker
ManageCA perm
Enable
ESC6 flag
🏛️
CA Server
Reconfigured
Exploit
ESC6
💀
Compromised
🔧 Fix:

Audit CA permissions: Open certsrv.msc → Right-click CA → Properties → Security tab. Only dedicated PKI administrators should have ManageCA. Document who has ManageCertificates and why.

⚠️ What might break?
Low risk. ManageCA should be restricted to PKI admins only. ManageCertificates may be needed by staff who approve certificate requests manually (like for smart card issuance). Check with your PKI team before removing access.
Quick Win: Run Locksmith with Invoke-Locksmith -Scans ESC1,ESC4,ESC6,ESC7,ESC8 to check all five Heavy Elements at once.
PKI

Understanding AD CS

Why Certificate Attacks Are Devastating

Survives Password Reset

Certificates work independently of passwords. Default validity is 1+ years. Even after password change, the certificate still works.

Golden Certificates

If the CA's private key is stolen, attackers can forge certificates for any user. These can't be revoked because they were never issued.

Poor Visibility

Most organizations don't monitor certificate issuance. Attackers operate in a blind spot.

Everywhere & Misconfigured

AD CS is common in enterprises. From the Certified Pre-Owned whitepaper: "In nearly every network so far, AD privilege escalation was possible."

TPL

Other Template Attacks (ESC2-3, ESC9-10, ESC13, ESC15)

Beyond ESC1 (Heavy Elements), these template issues can also lead to escalation.

ESC2 Any Purpose EKU / No EKU
HIGH

Templates with "Any Purpose" EKU (OID 2.5.29.37.0) can be used for any purpose including client authentication. Templates with no EKU (SubCA) can also be used for any purpose and could sign new certificates, though forged certs won't work for domain auth unless the SubCA is trusted by NTAuthCertificates.

Fix:

Don't grant enrollment rights to unprivileged users on Any Purpose or no-EKU templates. Review templates for SubCA configurations.

ESC3 Enrollment Agent Abuse
HIGH

Enrollment agent certificates let you request certs on behalf of other users. Two-step attack: get agent cert, then request as anyone.

Fix:

Restrict enrollment agent templates. Configure Enrollment Agent Restrictions on the CA.

⚠️ Impact:
Enrollment agents are used for smart card provisioning. Coordinate with smart card/badge team.
ESC9 No Security Extension (CT_FLAG_NO_SECURITY_EXTENSION)
MEDIUM

Template has the CT_FLAG_NO_SECURITY_EXTENSION flag (0x80000) set in msPKI-Enrollment-Flag, preventing the SID security extension from being embedded. Combined with GenericWrite on another user, allows impersonation via UPN manipulation. Discovered by Oliver Lyak.

Fix:

Remove CT_FLAG_NO_SECURITY_EXTENSION flag from templates. Set StrongCertificateBindingEnforcement = 2 on all DCs.

ESC10 Weak Certificate Mapping (Registry)
MEDIUM

DC registry setting StrongCertificateBindingEnforcement = 0 or 1 allows weaker certificate mapping methods. Combined with GenericWrite on another user, enables impersonation. Discovered by Oliver Lyak.

Fix:

Set StrongCertificateBindingEnforcement = 2 on all DCs. Apply KB5014754. Note: Full enforcement becomes mandatory September 2025.

⚠️ Impact:
Can break old certificates, third-party CAs, pre-KB5014754 certs. Test in Compatibility Mode (value=1) first and monitor Event ID 39 on DCs.
ESC13 OID Group Link
MEDIUM

Exploits Authentication Mechanism Assurance (AMA) where issuance policies are linked to AD groups.

Fix:

Audit OID objects for msDS-OIDToGroupLink. Don't link policies to privileged groups.

⚠️ Impact:
AMA is rarely used. If you don't know what it is, you're probably not using it.
ESC15 EKUwu (CVE-2024-49019)
HIGHPATCHED

Schema version 1 certificate templates allow requesters to inject Application Policy OIDs into the CSR. These are preferred over the template's configured EKUs. Discovered by Justin Bollinger at TrustedSec. Unlike ESC2 (explicit misconfiguration), ESC15 is a bug in how v1 templates process requests.

Fix:

Apply November 2024 patch (CVE-2024-49019). Alternatively, clone v1 templates to v2 (cloning automatically upgrades schema version and removes the vulnerability).

⚠️ Note:
Only affects schema version 1 templates where the attacker has enrollment rights. Default built-in templates like WebServer are v1 but typically restrict enrollment to privileged groups.
CA

Other CA Attacks (ESC12, ESC16)

ESC12 YubiHSM Key Access
CRITICAL

Shell access to a CA using YubiHSM may allow private key access. Requires CA compromise first.

Fix:

Treat CA servers as Tier 0. Restrict access. Consider network HSMs.

ESC16 Security Extension Disabled Globally
CRITICAL

If CA's DisableExtensionList includes the SID extension OID, ALL certificates lack security binding. Every template becomes ESC9-vulnerable.

certutil -config "CA\Name" -getreg policy\DisableExtensionList
Fix:

Ensure 1.3.6.1.4.1.311.25.2 is NOT in DisableExtensionList.

RLY

ESC11: NTLM Relay to RPC

ESC11 RPC Enrollment Relay
CRITICAL

Like ESC8 but targets RPC instead of HTTP. Vulnerable when CA doesn't enforce RPC encryption.

# Enable RPC encryption
certutil -setreg CA\InterfaceFlags +IF_ENFORCEENCRYPTICERTREQUEST
net stop certsvc && net start certsvc
⚠️ Impact:
Modern clients support encrypted RPC. May affect very old clients or custom tools.
ACL

Other ACL Attacks (ESC5, ESC14)

ESC5 PKI Object ACLs
HIGH

Other PKI objects can be targeted: CA computer object (RBCD), NTAuthCertificates (trust rogue CA), PKI containers.

Fix:

Audit ACLs on objects under CN=Public Key Services,CN=Services,CN=Configuration.

ESC14 altSecurityIdentities
MEDIUM

Write access to altSecurityIdentities allows configuring explicit certificate mapping for impersonation.

Fix:

Restrict write access. Monitor changes via Event ID 5136.

REF

Complete ESC Reference

ESCNameCategorySeverityNotes
ESC1Enrollee Supplies SubjectTemplateCRITICAL☢ Heavy Element
ESC2Any Purpose / No EKUTemplateHIGH
ESC3Enrollment AgentTemplateHIGH
ESC4Template ACL AbuseACLHIGH☢ Heavy Element
ESC5PKI Object ACLsACLHIGH
ESC6EDITF_ATTRIBUTESUBJECTALTNAME2CACRITICAL☢ Heavy Element (mitigated by KB5014754 alone, but dangerous with ESC9/16)
ESC7CA ACL AbuseACLCRITICAL☢ Heavy Element
ESC8NTLM Relay to HTTPRelayCRITICAL☢ Heavy Element
ESC9No Security ExtensionTemplateMEDIUMKB5014754
ESC10Weak Cert MappingRegistryMEDIUMDC setting
ESC11NTLM Relay to RPCRelayCRITICALCA flag
ESC12YubiHSM AccessCACRITICALNeeds shell
ESC13OID Group LinkTemplateMEDIUMAMA
ESC14altSecurityIdentitiesACLMEDIUM
ESC15EKUwuTemplateHIGHPatched
ESC16Security Ext DisabledCACRITICAL
DEF

Prioritized Mitigation Strategy

Fixes ordered by impact and ease of implementation. Start at the top.

🟢 Quick Wins (Do These Today)

Low risk, high impact, minimal testing required.

FixAddressesRiskTime
Disable EDITF_ATTRIBUTESUBJECTALTNAME2ESC6Very Low5 min
Audit template ACLs, remove non-admin writeESC4None30 min
Audit CA permissions (ManageCA/ManageCerts)ESC7Low30 min
Enable IF_ENFORCEENCRYPTICERTREQUESTESC11Low5 min
Check DisableExtensionList for SID OIDESC16None5 min
# Run Locksmith to check all of these
Invoke-Locksmith -Scans ESC4,ESC6,ESC7,ESC11,ESC16 -Mode 1

🟡 Moderate Effort (This Week)

May need coordination or testing, but straightforward.

FixAddressesRiskNotes
Remove "Supply in request" from auth templatesESC1LowWeb server certs may need different enrollment method
Remove enrollment rights from default templatesESC1, ESC15LowClone templates and grant enrollment on clones instead
Disable HTTP web enrollment OR enable EPAESC8MediumCheck if anyone actually uses /certsrv/ first
Apply November 2024 patchESC15StandardTest in non-prod like any patch

🔴 Long-Term Projects

Significant testing required, but important for defense in depth.

FixAddressesRiskNotes
StrongCertificateBindingEnforcement = 2ESC9, ESC10, ESC16HighTest in Compatibility Mode first (value=1), monitor Event ID 39. ⚠️ Becomes mandatory September 9, 2025!
Disable NTLM to CA entirelyESC8HighRequires Kerberos; breaks non-domain machines
Configure Enrollment Agent RestrictionsESC3MediumConfigured per-CA (not per-template). Coordinate with smart card team.
📖 Microsoft KB5014754: Certificate Mapping Changes & Enforcement Timeline

Detection & Incident Response

Events to Monitor (requires CA auditing enabled):
  • 4886: Certificate request received
  • 4887: Certificate approved and issued
  • 39 (KDC): Certificate mapping failure (use for testing StrongCertificateBindingEnforcement)
  • 5136: Directory object modified (altSecurityIdentities)
⚠️ Password Reset Is Not Enough
Certificates remain valid regardless of password changes. When an account is compromised, revoke all associated certificates. Note: Forged golden certificates cannot be revoked because they never appear in the CA database.

The Los Alamos of PKI

The nerds who split the certificate atom. Their research powers everything on this page.

Will Schroeder & Lee Christensen

Certified Pre-Owned (2021)

The Oppenheimer and Fermi of AD CS. Their 2021 whitepaper documented ESC1-8 and fundamentally changed how we view PKI security. This is your required reading.

Oliver Lyak

Certipy / @ly4k_

Built Certipy, the industry-standard tool for AD CS testing. Then kept finding more bugs (ESC9, ESC10, ESC11). Probably not done yet.

Justin Bollinger

TrustedSec

Found ESC15 (EKUwu) hiding in plain sight in default templates everyone assumed were safe. Named it "EKUwu" because of course he did.

SpecterOps Research Team

posts.specterops.io

The gift that keeps on giving. ESC13, ESC14, BloodHound, Certify, ForgeCert, PSPKIAudit. If it's breaking AD, they probably built the tool.

Jake Hildreth

Locksmith / TrustedSec (formerly Trimarc)

Got tired of explaining the same fixes, so he built Locksmith to do it for him. Now defenders can find AND fix AD CS issues without reading 100 pages of whitepapers.

Microsoft Security Team

Microsoft Docs

They wrote the manual. KB5014754, KB5005413, and all the official guidance. Sometimes the answer is actually in the docs. (Sometimes.)

🛠️ Tools of the Trade

What to use for finding and fixing AD CS issues.

Locksmith

PowerShell | Defender-focused

Best for: Blue teams and sysadmins. Finds AND fixes AD CS misconfigurations automatically. Supports ESC1-11, ESC13, ESC15. Run Invoke-Locksmith -Mode 4 to auto-remediate.

Certipy

Python | Offense & Defense

Best for: Penetration testing and security assessments. Industry standard for AD CS enumeration and exploitation. Full ESC1-16 coverage. BloodHound integration.

Certify

C# | Windows-native

Best for: Red teams needing a Windows executable. Enumeration and exploitation from SpecterOps. Pairs with Rubeus for authentication.

PSPKIAudit

PowerShell | Audit-focused

Best for: Incident response and certificate triage. Audits CA configurations, template permissions, and issued certificates. Great for post-breach investigation.

PingCastle

Windows | AD Health Check

Best for: Overall AD security posture. Detects AD CS presence and some misconfigurations, but not ESC-specific. Use alongside Locksmith/Certipy for full coverage.

BloodHound

Graph Analysis | Attack Paths

Best for: Visualizing AD CS attack paths in context of broader AD permissions. CE and Enterprise versions support AD CS edges. Import Certipy output for full picture.