Contact Us
Support
Partners
Downloads
Cayosoft®
Trials & Tools
Book a Demo
CTD-000205

Active Directory Certificate Services auditing not configured

Medium
Active Directory Certificate Services (ADCS)
Defense Evasion Discovery Impact

Signature Identity

CTD-000205
Threat ID
Version
IOE
Indicator Type

Threat Description

Active Directory Certificate Services (AD CS) is a critical identity infrastructure component used to issue and manage certificates. If AD CS auditing is not configured, certificate requests, issuance, revocation, configuration changes, and access attempts may not be logged. As a result, malicious or unauthorized certificate operations may go undetected, increasing the risk of privilege escalation, credential theft, and persistence.

For example, an attacker who compromises a user account could abuse a misconfigured certificate template to request a certificate that can be used for authentication as a privileged identity. Without AD CS auditing, this certificate request and issuance may not be recorded, making the activity difficult to detect, investigate, or report for compliance purposes.

MITRE ATT&CK: Attack Tactics

Defense Evasion Discovery Impact

D3FEND: Defend Tactics

Application Configuration Hardening

Remediation

To configure auditing for Active Directory Certificate Services on all AD CS servers:

  1. Create or edit a Group Policy Object (GPO) that applies to the AD CS server(s).
  2. In the GPO, go to:
    Computer Configuration > Policies > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Audit Policies > Object Access > Audit Certification Services
  3. Enable auditing for both Success and Failure events.
  4. Link the GPO to the Organizational Unit (OU) that contains the AD CS server(s).
  5. On each AD CS server, verify that Certificate Services auditing is enabled in the Certification Authority auditing settings.
  6. Run the following command on the AD CS server(s) to apply the policy:
    gpupdate /force
  7. Verify that certificate-related audit events are generated in the Security event log.

Frequently Asked Questions

What does Active Directory Certificate Services auditing not configured mean?

When AD CS auditing is not configured, certificate requests, issuance, revocation, configuration changes, and access attempts are not recorded in the security log, making it difficult to detect suspicious activity.

Unconfigured AD CS auditing increases the risk of privilege escalation due to undetected certificate operations that can be used by attackers to elevate their privileges, and credential theft through unauthorized certificate issuance or revocation.

Attackers can request certificates with elevated permissions without being detected, allowing them to authenticate as privileged identities. This makes it difficult for administrators to investigate or report on compliance requirements and supports later attacker activity such as lateral movement.

Cayosoft Guardian continuously monitors AD CS servers and identifies unconfigured auditing through regular scanning, providing visibility into the configuration of AD CS services and supporting investigation and review by administrators.

Cayosoft Guardian provides a centralized view of AD CS configuration, including unconfigured auditing, and alerts administrators on related events, enabling them to detect and respond to potential security risks in a timely manner.

Stop AD Threats As They Happen

Cayosoft Protector provides continuous monitoring and real-time alerts across your entire Microsoft Identity stack

Free Forever
Classification
Systems
Active Directory Certificate Services (ADCS)
Themes
Account protection Infrastructure Privileged Access Management
Attack Tactics
Defense Evasion Discovery Impact
Defend Tactics
Application Configuration Hardening
Indicator Types
IOE
Related Threats
CTD-000139
Kerberos Constrained Delegation: krbtgt Risks
Critical
CTD-000122
Active Directory Schema Update Permission Risks
Critical