Skip to content

AD-ADCS-004: ESC4: broad groups can modify a certificate template

high   Certificate services   MITRE ATT&CK T1649   Reads: LDAP

Broad groups hold write, WriteDacl or WriteOwner rights on a certificate template, so any user can reconfigure it into an ESC1 template.

Also known as: esc4

Why it matters

A certificate template is an ordinary directory object, and its settings are attributes: msPKI-Certificate-Name-Flag, msPKI-Enrollment-Flag, pKIExtendedKeyUsage, the template's own DACL. Whoever can write those attributes decides what the CA issues.

With write access an attacker turns the template into an ESC1 template (AD-ADCS-001): enable Supply in the request, add the Client Authentication EKU, clear manager approval, grant themselves Enroll, request a certificate naming a domain admin, then restore the original settings. The change is brief and the certificate stays valid long after. WriteDacl and WriteOwner reach the same result one step later, by granting the attacker the write rights first.

How ad-doctor detects it

ad-doctor reads the DACL of every certificate template over LDAP and reports a template when Everyone, Anonymous Logon, Authenticated Users, BUILTIN\Users, Pre-Windows 2000 Compatible Access, Domain Users, Domain Guests or Domain Computers hold any of:

  • GenericAll (full control) or GenericWrite
  • WriteDacl or WriteOwner
  • WriteProperty on all attributes (an ACE with no object type)

Write access to a single attribute or property set is not counted. Templates are reported whether or not a CA publishes them, because an unpublished template can be published later. Each object names the template and the groups, for example LabESC4 (Authenticated Users).

Attributes and probes read
  • nTSecurityDescriptor (template DACL)

Severity

Always high: write access to a template is one LDAP modify away from a certificate for any user.

False positives and limits

  • Narrower groups and single accounts with write access are not reported here; they appear as write template (ESC4) edges in AD-PATH-001 when the template is published.
  • The template owner is not evaluated: ad-doctor reads only the DACL, and an owner can always rewrite it. Check owners with the read-only command in the remediation.
  • An unpublished template cannot be used until someone with ManageCA publishes it, so the immediate risk is lower; fix it anyway, or delete the template.

Fix

  1. Review the template's permissions (read-only):

    $cfg  = (Get-ADRootDSE).configurationNamingContext
$path = "AD:CN=LabESC4,CN=Certificate Templates,CN=Public Key Services,CN=Services,$cfg"
$acl  = Get-Acl $path
$acl.Owner
$acl.Access | Where-Object ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|WriteProperty'

  2. Remove the write grants from the broad group, leaving its Read and Enroll rights alone, or use the template's Security tab in certtmpl.msc:

    $acl.Access |
    Where-Object { $_.IdentityReference -eq 'NT AUTHORITY\Authenticated Users' -and
                   $_.ActiveDirectoryRights -match 'GenericAll|GenericWrite|WriteDacl|WriteOwner|WriteProperty' } |
    ForEach-Object { [void]$acl.RemoveAccessRule($_) }
Set-Acl $path $acl -WhatIf

  3. Set the owner to Enterprise Admins or another tier-0 group if it is not one.

  4. Check whether it was abused: compare the template's whenChanged with your change records, and review Issued Certificates for this template for certificates whose subject differs from the requester; revoke those (certutil -revoke <serial> 1).

Verify

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ADCS-004

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ADCS-004"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References

Microsoft and vendors

Research

Tools

MITRE ATT&CK

Available since 0.1.0.