A weak certificate authority can undo years of password hardening. If an attacker can mint trust, they can log on, move laterally, and stay hidden without stealing a password hash.
That’s why ADCS hardening belongs in every 2026 Active Directory review. The checklist below focuses on the settings that cut risk fast: template abuse, least privilege, strong enrollment controls, private key protection, revocation hygiene, and continuous monitoring.
High-priority ADCS hardening checklist
Start with the issues that attackers abuse most often. Current Microsoft DART guidance on AD CS hardening lines up with field research like Black Hills’ write-up on AD CS abuse: template misuse and weak enrollment paths still drive many real compromises.
- Unpublish what you don’t use: Every published template is an attack surface. Remove old lab templates, duplicate templates, and anything left enabled “just in case.”
- Tighten Enroll and Autoenroll rights: Review every template access control list (ACL). Remove broad groups such as Authenticated Users, Domain Users, and oversized help desk groups from authentication-capable templates.
- Block enrollee-supplied subject data on auth templates: Review any template with “Supply in the request,” subject alternative name from request, or similar subject controls. On Client Authentication, Smart Card Logon, or machine auth templates, that setting can let a low-privilege user request a cert for another identity.
- Turn off exportable private keys by default: If a template marks private keys as exportable, theft gets easier. Only allow export when an application has a clear, documented need.
- Require approval for risky templates: Use manager approval or authorized signatures for Enrollment Agent, Key Recovery Agent, code-signing, and other high-impact templates. Those controls add friction where it matters.
- Lock down web enrollment and relay exposure: If Web Enrollment, CES, or CEP isn’t needed, remove it. If it stays, force HTTPS, turn on Extended Protection for Authentication (EPA), apply KB5005413-related protections, and reduce NTLM use on AD CS servers.
- Separate certificate authority roles: Don’t let one account manage the CA, approve requests, and edit templates. Build small CA admin groups and keep Domain Admins or Enterprise Admins out of daily PKI work.
- Use strong identities for admin and approval actions: Keep CA tasks on dedicated admin accounts from trusted workstations. Add phishing-resistant multifactor authentication where your management path supports it, and never use a daily user account for certsrv or template changes.
A template with broad enroll rights, client authentication, and subject supply turned on is a direct path to privilege escalation.
One fast review pattern works well. Look first for templates that combine authentication EKUs, broad enrollment rights, and subject control from the requester. That trio is where many ESC-style abuse paths begin, including the misconfigurations described in ESC1 research from Cobalt.
Advanced hardening for keys, revocation, and high-value templates
After the quick wins, protect the certification authority itself. Think of the CA private key as the mold for every lock in the building. If that mold is copied, every door becomes suspect.
- Keep the root CA offline: For most enterprise public key infrastructure (PKI) deployments, an offline root CA and online issuing CAs still give the safest split. Power up the root only for planned signing and certificate revocation list publishing.
- Back CA keys with a hardware security module (HSM): Use an HSM for root and issuing CA private keys. In 2026, FIPS 140-3 validated hardware is preferred, while FIPS 140-2 Level 3 remains common in existing estates. Generate keys inside the HSM and keep them non-exportable.
- Restrict high-risk templates harder than the rest: Enrollment Agent, Key Recovery Agent, Encrypting File System (EFS), and domain controller templates deserve extra scrutiny. Publish them only when needed, scope rights tightly, and disable or revoke them when the work ends.
- Clean up revocation infrastructure: Publish certificate revocation lists (CRLs) and delta CRLs on schedule. Check that CDP and AIA locations are reachable, current, and monitored, because stale revocation data turns a revoked cert into a lingering risk.
- Harden the CA host and backup path: Keep the CA on a dedicated server, remove extra roles, block casual logon, and protect backups like crown jewels. A stolen CA backup can be just as damaging as a live server compromise.
If budget blocks HSM coverage everywhere, start with the offline root and the highest-value issuing CA first. For broader design guidance, NCC Group’s guide to defending ADCS is a useful cross-check against internal standards.
Continuous monitoring and validation keep hardening from drifting
ADCS hardening is never “done.” Templates drift, groups expand, and old services stay online after the original owner leaves.
- Turn on granular auditing: Capture template changes, CA config changes, request submission, issuance, denial, revocation, and role assignment. Then forward those records to your SIEM so they don’t stay trapped on the CA.
- Baseline normal certificate activity: Track which accounts request which templates, from which hosts, and at what volume. A spike in sensitive templates should stand out right away.
- Alert on dangerous setting changes: Watch for newly published templates, loosened ACLs, exportable keys enabled, subject supply turned on, or manager approval removed. Those changes often matter more than raw request volume.
- Correlate certificate abuse with identity signals: Microsoft Defender for Identity and similar tools help tie certificate events to lateral movement and privilege escalation. Review CA security descriptors and template ACLs on a fixed schedule, not only after an incident.
- Test the environment like an attacker: Run scheduled PKI reviews and purple-team exercises for relay exposure, ESC paths, and risky templates. CrowdStrike’s ESC1 investigation guide is a strong reference for triage and hunting ideas.
Also rehearse recovery. Restore a CA backup in a lab, validate CRL publication, and confirm you can revoke a bad cert quickly. If the team can’t answer “who can issue a logon certificate right now?” in a few minutes, the review still has gaps.
Final pass before you call AD CS hardened
The safest AD CS deployment is boring. Templates are few, rights are narrow, keys stay protected, and unusual enrollment leaves a clear trail. Start with the quick wins, then move to HSM-backed keys, revocation hygiene, and constant review. In 2026, ADCS hardening means treating certificate trust like a privileged credential, because that’s exactly what it is.
