AD-ADCS-018: CA audit filter not fully on¶

low medium   Certificate services   MITRE ATT&CK T1649   Reads: CA registry probe

An enterprise CA's AuditFilter is not 127 or was never set, so at least one audit category is off.

Also known as: ca-audit-filter

Why it matters¶

A CA only writes audit events for the categories in its audit filter. Without Issue and manage certificate requests, a certificate requested for a Domain Admin through ESC1 or ESC8 leaves no CA audit event. Certificates also outlive password resets, so the record of what was issued is what an investigation starts from.

Microsoft's report on real ESC1 and ESC8 intrusions (2026-10-30) asks defenders to enable the Certification Services audit subcategory for success and failure, and to configure the audit filter to record request and issuance activity.

How ad-doctor detects it¶

During collection ad-doctor reads AuditFilter next to the CA's other settings over \pipe\winreg. The value is a bitmask, and all seven categories on make 127:

Each CA with a bit off is listed, with the categories that are off. A CA where nobody ever configured auditing has no such value (seen on a new Server 2025 CA). That read worked, so it is listed as AuditFilter not set, with every category off. Reading it as "nothing audited" is an inference: nothing turned a category on. A value that could not be read is different: it is unknown, and AD-ADCS-016 reports it.

127 does not prove events are written. The CA hands events to the Security log only when the Certification Services audit subcategory is on, and ad-doctor does not read the CA's audit policy.

Severity¶

Medium when Issue and manage certificate requests (bit 4) is off, or the value does not exist: that is the activity Microsoft's October 2026 intrusion report tells defenders to record. Low when only other categories are off. Never higher: this is a detection gap, not a way in.

False positives and limits¶

• A category turned off on purpose. Record it in an accepted-risk file.

Fix¶

1. See the current value on the CA (read-only):

   certutil -getreg CA\AuditFilter
   

2. Turn on every category, then restart the service:

   certutil -setreg CA\AuditFilter 127
   Restart-Service certsvc
   

3. Enable the audit subcategory on the CA, for success and failure, through a GPO or with auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable.

4. Keep the events: send the CA's Security log to your SIEM.

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ADCS-018

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ADCS-018"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

Related checks¶

• AD-ADCS-016
• AD-ADCS-001
• AD-ADCS-010

References¶

Microsoft and vendors

• Help desk impersonation and AD CS abuse: investigating ESC1 and ESC8 intrusion paths
• Securing PKI: Appendix B: Certification Authority Audit Filter

MITRE ATT&CK

• T1649

New in the next release.