Start with who can ask for what
A certificate template is a policy object, an enrolment path and an authorization decision at the same time. Review the subject-name flags, intended purposes and enrolment permissions together; checking any one in isolation misses the attack path.
- Requester-supplied subject or SAN values
- Authentication-capable extended key usages
- Broad enrolment rights without approval
- Template owners or ACLs that low-privilege users can change
Then inspect the enrolment surface
Legacy web enrolment, NDES and relayable HTTP endpoints can make a safe-looking template dangerous in practice. Document every enrolment endpoint, its authentication method and whether channel binding and HTTPS are enforced.
Fix the path, not just the flag
A durable remediation removes the risky combination, validates that issued certificates still work and records the approved template state. The closing step is a repeatable verification script, not a screenshot of one console.
This field note is general technical guidance. The safe remediation sequence depends on the hierarchy, clients and controls in the actual estate.