Audit AD CS Certificate Templates and Issuance with PowerShell
Audit certificate templates, template permissions, recently issued certs, and CA health from one PowerShell workflow.
Active Directory Certificate Services is one of those platforms that silently runs critical authentication, and silently becomes a security risk when nobody audits it. The recent ESC-class research has made it clear that template misconfigurations are a real path to domain compromise.
PowerShell, especially with the PSPKI module, can audit every dimension of AD CS that matters. PSForge gives you the AD CS tasks ready to assemble into a workflow that keeps PKI honest.
What an AD CS audit needs to surface
- Every published template with its purposes and the groups that can enroll
- Templates that allow Enrollee Supplies Subject combined with client authentication
- Templates with low approval requirements that issue privileged authentication certs
- Recently issued certificates with subject and requester for spot review
- CA health: backlogged requests, failed issuances, AIA and CDP availability
- Expired or expiring CA certificates and CRL freshness
Why this becomes a workflow
Most AD CS environments have not been audited end-to-end since they were stood up. A scripted workflow that runs monthly is the only realistic way to keep templates and issuance under control.
PSForge lets you assemble the AD CS tasks into one workflow, generate the PowerShell, and run it from a domain-joined management server with the right read access.
Example AD CS audit workflow
- Connect to each issuing CA with the appropriate read access
- Enumerate every published template with purposes and enrollment permissions
- Flag templates with Enrollee Supplies Subject plus client authentication EKU
- Identify templates that issue authentication certs without manager approval
- Pull the last 30 days of issued certificates with subject and requester
- Check CA health metrics including backlog, failed requests, and CRL publish time
- Validate AIA and CDP URLs are reachable and current
- Send the consolidated PKI audit to the AD and security teams
Final thoughts
AD CS is too central to leave unaudited.
PSForge makes it easy to build a single PowerShell workflow that keeps templates, issuance, and CA health under steady review so the next pen test is not the first time anyone looked.