AD CS Misconfiguration and Discovery Response
On template/CA change, canary alert, or discovery tool detection with no evidence of active exploitation, close the vulnerability, identify the source, and apply permanent hardening.
Prepare
9 steps- CA Audit Log
Activate Certification Services auditing on the CA: `auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable`
- Template Change Log
Add template change events to CA audit filter: `certutil -setreg CA\AuditFilter +128` then `net stop certsvc && net start certsvc`
- DC AD Change Log
Enable "DS Access > Audit Directory Service Changes" policy on all DCs; Event 5136 must be forwarded to SIEM.
- SIEM Coverage
Verify that events 4882, 4885, 4886, 4887, 4888, 4899, 4900, 5136, 4768 are searchable and generating alerts in SIEM.
- Vulnerability Inventory
Schedule monthly Certipy weak template scan: `certipy find -u <user>@<domain> -p <password> -dc-ip <DC-IP> -vulnerable`; also run with Locksmith: `Invoke-Locksmith`
- CA Flag Check
Periodically verify that the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag is absent in `certutil -getreg policy\EditFlags` output and that `IF_ENFORCEENCRYPTICERTREQUEST` is enabled in `certutil -getreg CA\InterfaceFlags` output.