AD-CHAIN-003: Coercion plus web enrollment relay (ESC8)¶

medium high Attack paths MITRE ATT&CK T1187, T1557.001, T1649 Reads: derived from other findings

A CA's web enrollment accepts NTLM over HTTP and DC coercion is confirmed through the Print Spooler or assumed, so a user can relay a DC's authentication into a DC certificate (ESC8).

Also known as: esc8-chain

Why it matters¶

The ESC8 attack from Certified Pre-Owned:

Any domain user makes a DC authenticate to their host through the Print Spooler, EFSRPC (PetitPotam) or another coercion method. Microsoft's post of 2026-10-30 describes a real intrusion that used PetitPotam with ESC8.
They relay that NTLM authentication to the CA's web enrollment page (/certsrv/) over plain HTTP, which has no signing or channel binding to stop a relay (AD-ADCS-010).
Acting as the DC's computer account, they request a certificate from the DomainController (or Machine) template.
They use the certificate for PKINIT, get the DC's TGT and run DCSync.

The whole chain runs in minutes and leaves the attacker with a certificate that stays valid after password changes.

The policy Restrict NTLM: Outgoing NTLM traffic to remote servers set to Deny all (RestrictSendingNTLMTraffic = 2) on the DCs stops step 2 for NTLM: the coerced DC no longer sends NTLM to the attacker. It does not stop a Kerberos relay of the same coerced connection to web enrollment (Synacktiv showed this with a crafted DNS record), and it says nothing about the CA, so the endpoint stays reported as AD-ADCS-010.

How ad-doctor detects it¶

A compound finding. It fires when the HTTP probe found web enrollment on a CA host: GET /certsrv/ over plain HTTP returned 401 with NTLM or Negotiate in WWW-Authenticate (AD-ADCS-010). The grade then depends on two more facts:

whether a DC opened the spoolss named pipe in the SMB probe (the Print Spooler is running, AD-INF-009). The spooler is the only coercion method ad-doctor tests, so without it the text says coercion is assumed possible;
whether MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\RestrictSendingNTLMTraffic is 2 in the GptTmpl.inf of a GPO that applies to every DC, using the same link, Block Inheritance, Enforced and security filter logic as the local group checks.

The second one is reported as one of three states, and only the first lowers the grade:

denied: every enabled DC gets the value from a GPO with no doubt about its scope;
not denied: some DC has no GPO that sets it. A value set by hand in a DC's registry cannot be seen, so this means "no GPO sets it", not "NTLM is allowed";
unknown: SYSVOL was not read, the snapshot is older, the security settings of a GPO that reaches the DC could not be read (even when another GPO denies NTLM), GPOs disagree (precedence between GPOs is not worked out), the GPO has a WMI filter or an unreadable security filter, or a GPO reaching the DC lists exceptions in ClientAllowedNTLMServers: the detail then says "denied with exceptions" and names them, because an exception can cover the relay host.

A GPO with no GptTmpl.inf counts as read and empty. One limit can make denied too kind: a deny ACE that excludes a DC from the GPO is not seen, because deny ACEs are not parsed.

The objects are the web enrollment URLs, for example http://ca01.corp.example/certsrv/. The HTTP probe uses --http-port (80 by default, 0 skips it); both probes are skipped with --no-probes. Only endpoints over plain HTTP count here: whether an HTTPS endpoint has Extended Protection is not known, so AD-ADCS-019 lists those instead and this check can miss a relay to one of them.

Attributes and probes read

probe: spoolss pipe on each DC
probe: GET /certsrv/ over HTTP (WWW-Authenticate)

Severity¶

High when a DC answered the spooler probe: a domain user gets a certificate for a domain controller and from it DCSync, with public tools and no other foothold. Medium when no spooler was confirmed: coercion is then assumed possible, not shown. Also medium, whatever the spooler state, when a GPO that reaches every DC denies outgoing NTLM: the NTLM relay is blocked, but the same coerced DC can be relayed to /certsrv/ with Kerberos. That takes more work (a crafted DNS record), and it needs Negotiate or Kerberos on the site; the probe does not record which scheme was offered, so an NTLM-only site is graded the same.

False positives and limits¶

The CA's web enrollment requires HTTPS with Extended Protection on another port while plain HTTP still answers: the HTTP endpoint is still relayable. Remove it.
Coercion really is blocked by RPC filters or a firewall. ad-doctor cannot see that, so the finding stays at medium. Fixing web enrollment clears it.

Fix¶

Fix the CA side: that is what closes the chain, because coercion has more routes than the spooler:

Remove web enrollment if nobody uses it:
```
Uninstall-AdcsWebEnrollment -WhatIf
```
Otherwise require HTTPS and Extended Protection for Authentication on /certsrv/ and the CES endpoints, and disable NTLM there (KB5005413): in IIS, require SSL and set Extended Protection to Required under Windows Authentication, then remove the plain HTTP binding.
Stop and disable the Print Spooler on every DC, preferably with the Default Domain Controllers Policy (System Services > Print Spooler = Disabled). This removes one route.

If you can test it first, also set Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers to Deny all in a GPO for the DCs.

Look for certificates already issued to DCs from unexpected requesters, and revoke them:

certutil -view -restrict "CertificateTemplate=DomainController" -out "RequestID,RequesterName,NotBefore,SerialNumber"

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-CHAIN-003

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-CHAIN-003"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References¶

Microsoft and vendors

Research

Tools

MITRE ATT&CK

Available since 0.1.0.