Dangerous ACLs expose certificate containers

This issue is rated critical because it enables attackers to directly compromise the domain by introducing a malicious CA. This can lead to significant operational impact, making it a high-risk issue that requires immediate attention.

Attackers can introduce a malicious CA into the trust hierarchy by modifying or deleting certificates stored within the NTAuthCertificates container. This allows them to gain unauthorized access and potentially escalate privileges, leading to domain compromise.

Cayosoft Guardian continuously monitors the permissions on the NTAuthCertificates container in Active Directory, detecting unexpected changes or additions. When an issue is detected, Guardian flags it as a security issue so administrators can take corrective action.

Cayosoft Guardian alerts administrators to remove unexpected permissions on the NTAuthCertificates container, providing visibility and supporting investigation into potential attacker activity. This helps prevent attackers from introducing a malicious CA and reduces the risk of privilege escalation and domain compromise.