Microsoft AD CS: Operations, Hardening, and Migration Guide

Active Directory Certificate Services (AD CS) is Microsoft’s role-based PKI platform for Windows Server that issues, manages, and revokes certificates for domain-joined users, devices, and services, and requires deliberate hardening to avoid well-documented misconfiguration-based attack paths.

AD CS lets organizations run an internal Certificate Authority integrated with Active Directory, issuing certificates through templates, NDES, and auto-enrollment. Because misconfigured templates and permissions are a well-known privilege escalation path (commonly referenced as ESC1 through ESC8+), AD CS deployments need specific hardening steps and, for aging environments, a clear migration plan toward modern certificate lifecycle management.

Key Takeaways

• AD CS integrates directly with Active Directory, letting certificate templates apply role-based permissions the same way other AD objects do.
• Misconfigured certificate templates are a well-documented privilege escalation path, commonly catalogued as ESC1 through ESC8+ in offensive security research.
• The most common critical misconfiguration (often labeled ESC1) is a template that allows a low-privileged user to specify an arbitrary Subject Alternative Name while also permitting client authentication.
• AD CS hardening requires auditing every certificate template’s permissions, not just the CA server’s own configuration, since template misconfiguration is the more common real-world attack path.
• Many organizations are migrating AD CS operations, or specific workloads like device certificate issuance, to cloud-based or hybrid certificate lifecycle management platforms to reduce operational burden and improve automation.

What are the Most Common AD CS Misconfigurations to Audit For?

Common issue (informal ESC label)	Risk
Template allows attacker-specified SAN + client auth (ESC1)	Low-privileged user can request a certificate impersonating any other account
Template has dangerous enrollment rights misconfigured (ESC2-ESC4)	Overly broad enroll or write permissions let unauthorized users obtain sensitive certificate types
Vulnerable NTLM relay to AD CS endpoints (ESC8)	Relayed authentication can be used to request a certificate on a victim’s behalf
Weak or missing template access control review process	Misconfigurations introduced during changes go undetected without periodic review

What Does a Basic AD CS Hardening Checklist Include?

1. Audit every certificate template’s enrollment and write permissions, not just the CA server’s own ACLs.
2. Restrict or remove templates that allow low-privileged users to specify an arbitrary Subject Alternative Name.
3. Require manager approval or explicit issuance for high-risk certificate templates, such as those enabling client or smart card authentication.
4. Disable or tightly control HTTP-based enrollment endpoints, which are more susceptible to NTLM relay attacks than Kerberos-based enrollment.
5. Restrict local administrator membership on CA servers to a small, well-audited PKI admin group.
6. Enable and monitor CA audit logging, reviewing issuance events for anomalies on a regular schedule.

When Should an Organization Migrate Off, or Modernize, its AD CS Deployment?

AD CS itself remains a supported, capable platform, so “migration” often means modernizing specific workflows rather than replacing AD CS outright: automating certificate lifecycle management around it, extending enrollment to cloud-managed and non-domain-joined devices, or consolidating multiple aging CA hierarchies that have accumulated years of template sprawl and undocumented changes. Organizations should treat a migration or modernization project as warranted when template audits reveal significant unmanaged risk, when manual certificate handling is causing outages, or when business needs (like extending certificates to Entra ID-joined devices) have outgrown the original AD CS design.

How does a Typical ADCS Modernization Project Proceed?

1. Audit the existing hierarchy: templates, permissions, issued certificate inventory, and CA server configuration.
2. Remediate critical misconfigurations first, particularly any templates matching known privilege escalation patterns.
3. Design the target state: which workloads stay on AD CS, which move to cloud-managed enrollment, and how NDES/Intune fit in.
4. Migrate or reissue certificates in priority order, starting with the highest-risk or highest-business-impact systems.
5. Decommission or consolidate legacy CA hierarchies once dependent certificates have been migrated or allowed to expire naturally.

How Encryption Consulting Helps

How Encryption Consulting HelpsPKI Services audits and hardens AD CS deployments against known template misconfigurations, while CertSecure Manager extends certificate lifecycle automation across both AD CS-issued and cloud-managed certificates during a modernization project. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices.

Frequently Asked Questions

What is the most critical AD CS misconfiguration to check for?

The most critical and commonly cited misconfiguration is a certificate template that allows a low-privileged requester to specify an arbitrary Subject Alternative Name while also permitting client authentication, since this lets an attacker request a certificate that impersonates a privileged account.

Is AD CS still a good choice for enterprise PKI in 2026?

AD CS remains a capable, well-supported platform for organizations with a strong Windows and Active Directory footprint, but it requires deliberate template and permission hardening, and many organizations pair it with automated certificate lifecycle management to reduce manual overhead.

Do I need to migrate away from AD CS entirely?

Not necessarily. Many organizations modernize specific workflows, such as extending enrollment to cloud-managed devices or automating lifecycle management, while keeping AD CS as the underlying CA, rather than replacing the platform outright.

How often should AD CS certificate templates be audited?

There is no universal answer, but given how easily template permissions can drift during routine administrative changes, a periodic audit, at minimum annually and after any significant AD or PKI change, is a reasonable baseline for most organizations.

Harden and Modernize Your AD CS Deployment

Take the next step PKI Services audits AD CS for known misconfigurations, and CertSecure Manager extends automated lifecycle management across your certificate estate. Explore PKI Services to schedule an AD CS audit.