AD-ADCS-003: ESC3: enrollment agent template open to broad groups¶

high   Certificate services   MITRE ATT&CK T1649   Reads: LDAP

A published template that broad groups can enroll in issues Certificate Request Agent certificates, letting any user request certificates on behalf of others.

Also known as: esc3

Why it matters¶

An enrollment agent signs certificate requests on behalf of other users, for example a help desk issuing smart cards. The certificate that makes someone an agent carries the Certificate Request Agent EKU (1.3.6.1.4.1.311.20.2.1).

If any domain user can enroll in an agent template, the attack takes two requests:

1. Request an agent certificate from this template.
2. Use it to co-sign a request for administrator through any published template that accepts agent-signed requests: a schema v1 template valid for authentication (the built-in User template is one), or a v2+ template that requires one authorized signature with the Certificate Request Agent application policy.

The CA then issues a logon certificate for the victim, valid until it expires or is revoked, regardless of the victim's password. Unless the CA has enrollment agent restrictions configured, an agent may enroll for any user through any template.

How ad-doctor detects it¶

ad-doctor reads every certificate template and the enterprise CAs over LDAP and reports a template when all of these hold:

The EKU list is msPKI-Certificate-Application-Policy when set, otherwise pKIExtendedKeyUsage. Each object names the template and the broad groups that can enroll, for example LabESC3 (enroll: Domain Users). Templates with the Any Purpose EKU also work as agent templates and are reported by AD-ADCS-002.

Severity¶

Always high: an enrollment agent certificate is the first half of a request for any user's logon certificate.

False positives and limits¶

• Enrollment agent restrictions on the CA (CA properties, Enrollment Agents tab) live in the CA's configuration, not in LDAP, so ad-doctor cannot see them. If the CA limits each agent to specific templates and target groups, the finding is mitigated but not removed: restrict who can enroll in the agent template as well.
• The second template (one that accepts agent-signed requests) is not checked. The built-in User template qualifies when it is published, which is common.
• Narrower enrollment groups are not reported here; see AD-PATH-001.

Fix¶

1. Restrict enrollment in the agent template to the named agents that need it. In certtmpl.msc, Security tab, remove Enroll and Autoenroll from Domain Users, Domain Computers, Authenticated Users and Everyone.

2. Require CA manager approval for agent certificates (sets CT_FLAG_PEND_ALL_REQUESTS):

   $cfg = (Get-ADRootDSE).configurationNamingContext
   $dn  = "CN=LabESC3,CN=Certificate Templates,CN=Public Key Services,CN=Services,$cfg"
   $t   = Get-ADObject $dn -Properties 'msPKI-Enrollment-Flag'
   Set-ADObject $dn -Replace @{'msPKI-Enrollment-Flag' = ($t.'msPKI-Enrollment-Flag' -bor 2)} -WhatIf
   

3. Configure enrollment agent restrictions on the CA: certsrv.msc > the CA > Properties > Enrollment Agents > Restrict enrollment agents, and allow each agent only the templates and target groups it serves.

4. Stop publishing the agent template if smart card enrollment is not in use:

   Remove-CATemplate -Name LabESC3 -WhatIf
   

Then review Issued Certificates for requests signed by an agent certificate from this template and revoke any that were not sanctioned (certutil -revoke <serial> 1).

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ADCS-003

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ADCS-003"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

Related checks¶

• AD-ADCS-001
• AD-ADCS-002
• AD-ADCS-004
• AD-PATH-001

References¶

Microsoft and vendors

• Defender for Identity: Edit misconfigured enrollment agent certificate template (ESC3)
• Certificate template concepts in Windows Server

Research

• Certified Pre-Owned: Abusing Active Directory Certificate Services (whitepaper, ESC3)

Tools

• Certipy wiki: Privilege escalation (ESC3)

MITRE ATT&CK

• T1649

Available since 0.1.0.