Microsoft certificate services
It can issue the identity that unlocks your estate — and one weak template, unavailable revocation point or mishandled CA key can undermine the whole chain.
Request an ADCS auditWhy ADCS
A template flag may be legitimate. A permission may be legitimate. Together, they can become a domain escalation path.
Template flags and permissions can let an ordinary user request a certificate for a privileged identity.
CRL, AIA and OCSP failures often remain invisible until clients can no longer build or validate a chain.
Software-held keys and untested backups turn a server incident into a PKI-wide recovery problem.
How a health check runs
Thirty minutes. Hierarchy, scale, constraints, and whether an audit is even the right first move. If it is not, we will say so. No credentials change hands on this call.
Scripted and non-intrusive. Run by your team, or by us with your team watching. Nothing is written, nothing is restarted, nothing is enrolled — and the script is yours to read first.
Templates and permissions tested against the known escalation paths. Revocation, key protection, algorithm and validity hygiene tested against operational failure modes.
Every finding with impact, exploitability and a specific remediation — ordered so that the first week of work removes the most risk.
A working session with your engineers. You can fix it yourselves, or we can. Either way you keep the documentation and the verification scripts.
PS> Get-CAHierarchy -Summary
Forest : corp.example.com
Enterprise CAs : 3
ROOT-CA-01 Offline SHA256 RSA4096 exp 2039
ISSUING-CA-01 Online SHA256 RSA2048 exp 2031
ISSUING-CA-02 Online SHA1 RSA2048 exp 2029
Published templates : 41
Endpoints (est.) : 5,000 – 15,000
# scope agreed. no credentials exchanged.PS> .\Collect-AdcsEvidence.ps1 -ReadOnly -Out .\evidence
[ok] enumerating CAs ................ 3
[ok] exporting template ACLs ........ 41
[ok] reading CA registry ............ 6
[ok] probing CDP / AIA endpoints .... 14
[ok] sampling issued certificates ... 500
[--] write operations attempted .... 0
[--] services restarted ............. 0
evidence written · SHA256 manifest signedPS> certutil -v -dstemplate WorkstationAuth
msPKI-Certificate-Name-Flag = 1 (0x1)
CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT
pKIExtendedKeyUsage = "1.3.6.1.5.5.7.3.2"
Client Authentication
msPKI-Enrollment-Flag = 0 (0x0)
manager approval not required
>> supplied SAN + client auth + no approval
>> matches ESC1 — flag CRITICALPS> Get-Content .\report\index.md
# Findings — ordered by risk removed
1 CRITICAL ESC1 WorkstationAuth
2 CRITICAL ESC8 web enrolment over HTTP
3 HIGH ESC4 ACL: Authenticated Users
4 HIGH KEY-01 issuing CA key in software
5 HIGH REV-02 CDP unreachable externally
… 13 further findings
# each finding: impact · exploitability · fixPS> .\Verify-Remediation.ps1 -Finding ESC1
before ENROLLEE_SUPPLIES_SUBJECT = 1
after ENROLLEE_SUPPLIES_SUBJECT = 0
after msPKI-Enrollment-Flag = PEND_ALL_REQUESTS
[ok] re-test: SAN injection refused
[ok] re-test: issued certificates unaffected
# your engineers ran this. we watched.Representative output. Collection scripts are supplied for your review before anything runs.
Flagship engagement
We assess your CA hierarchy, certificate templates, permissions, revocation infrastructure and key protection against known attack paths and operational failure modes — then hand you a risk-ranked remediation roadmap your engineers can work straight from.
ADCS engagements
Fixed-price assessment
We assess your CA hierarchy, certificate templates, permissions, revocation infrastructure and key protection against known attack paths and operational failure modes — then hand you a risk-ranked remediation roadmap your engineers can work straight from.
You receiveRisk-ranked findings, evidence appendix, remediation roadmap and engineer walkthrough.
Design and implementation project
A defensible hierarchy built around an offline root, resilient issuing tier, controlled templates, autoenrolment and durable revocation publishing.
You receiveArchitecture, build scripts, CP/CPS documentation, ceremony records and operational runbooks.
Scoped transformation
Modernise CA operating systems, keys, algorithms or hierarchy while preserving trust for the certificates and applications already in service.
You receiveDependency inventory, migration sequence, rollback gates, validation plan and handover.
Priority or planned support
Rapid diagnosis for failed autoenrolment, broken chains, revocation outages, template errors and suspected CA compromise.
You receiveIncident hypothesis, evidence-led diagnosis, safe recovery sequence and post-incident actions.
Common questions