Audit and Secure AD CS Certificate Templates

An enterprise certification authority (CA) issues certificates from templates stored in Active Directory. A template’s permissions, subject-name rules, certificate purpose, and issuance requirements together determine who can obtain a usable identity credential. This guide starts with an inventory, then pilots a reviewed change to one template. For a read-only exposure assessment, see Review AD CS Certificate Template Enrollment Exposure. This guide applies to enterprise CAs; standalone CAs do not use AD certificate templates.

Protect the CA before changing a template

Changing a published template can interrupt enrollment for every CA that uses it. Use a change record, a tested CA recovery plan, and an application owner. Do not remove a template or revoke issued certificates as a routine audit step. Existing certificates can remain valid after template changes; plan their treatment separately.

01

Define the CA and Template Scope

Preparation

Identify the issuing enterprise CAs, applications that consume their certificates, and the group that owns each template. Run the inventory from an approved administrative workstation with RSAT AD CS tools. Use an account with read access for inspection; reserve template edit rights for the approved pilot. Record the forest, CA name, and maintenance window.

# Read-only inventory; run with the AD CS administration tools installed.
certutil.exe -config - -ping
# Replace this sample with the CA configuration string you selected above.
certutil.exe -config 'CA01.contoso.com\Contoso Issuing CA' -catemplates

❯ What to Verify

The selected CA responds and lists its published template short names.
Record the exact CA configuration string and template short name.

Published on a CA differs from present in AD

The Certificate Templates snap-in shows template objects in the forest. The Certification Authority snap-in’s Certificate Templates node shows what one CA is configured to issue. Review both before deciding a template is unused.

02

Inventory Templates and Their Owners

Discovery

Open Certificate Templates with certtmpl.msc. For each authentication, code-signing, enrollment-agent, or broadly enrolled template, record the short name, display name, superseded templates, intended application, and owners. On each issuing CA, open Certification Authority > Certificate Templates to confirm publication. Do not assume a similarly named template has identical settings.

Run: certtmpl.msc
Run on the CA: certsrv.msc
Inventory columns: template short name | issuing CA | intended identity |
                  enrollment group | application owner | current consumers

❯ What to Verify

Every high-impact published template has an owner and a documented use.
Unowned templates are flagged for investigation, not deleted immediately.

03

Review Identity and Certificate Purpose

Risk Review

In a template’s Properties, inspect Subject Name, Extensions, Request Handling, and Issuance Requirements. For an authentication-capable template, treat Supply in the request as high impact because the requester can supply identity information. Check whether the template has a legitimate need for Client Authentication or other authentication application policies, whether private-key export is necessary, and whether manager approval or authorized signatures are part of the intended control.

Record: subject source | SAN handling | application policies/EKUs |
        private-key export | manager approval | required signatures

❯ What to Verify

Each sensitive setting is explained by the owning application's requirements.
Unexpected combinations are escalated before any configuration change.

Check the CA-wide SAN setting

The CA flag EDITF_ATTRIBUTESUBJECTALTNAME2 can allow requesters to supply SAN values regardless of a template’s Subject Name choice. Review the flag and the CA’s enrollment policy with your PKI owner. Do not toggle a CA-wide setting without testing every dependent enrollment flow.

04

Inspect Enrollment and Template Permissions

Access Review

On the Security tab, record who can Read, Enroll, Autoenroll, or modify the template. Trace nested groups for broad principals such as all domain users or computers. Evaluate permissions against the template’s identity risk, rather than treating any one checkbox as proof of a vulnerability. If removing Authenticated Users from Read, ensure every issuing CA computer account retains Read access to the template.

certtmpl.msc > selected template > Properties > Security
Review: Read | Enroll | Autoenroll | Write | Full Control

❯ What to Verify

Enrollment and edit rights are mapped to named groups and owners.
CA computer Read access is included in the proposed permission design.

05

Create a Narrow Pilot Template

Controlled Change

For a remediation that changes application behavior, duplicate the closest approved template instead of editing a heavily used one in place. Give the duplicate a distinct name. Set the required subject source, application policies, key settings, issuance requirements, and a small pilot enrollment group. Grant Autoenroll only if the application needs it. Let AD replication complete, then publish the pilot template on one intended issuing CA.

certtmpl.msc > approved template > Duplicate Template
Properties > General / Subject Name / Extensions /
             Request Handling / Issuance Requirements / Security
certsrv.msc > Certificate Templates > New > Certificate Template to Issue

❯ What to Verify

The pilot template has a distinct short name, restricted enrollment group,
documented owner, and appears only on the intended issuing CA.

06

Test Authorized and Unauthorized Requests

Validation

From a pilot computer or account, request a certificate using the correct Current User or Local Computer store. Verify the issued certificate’s subject, SAN, issuer, template, intended purpose, and chain. Repeat with a test principal outside the enrollment group: the request must fail. If manager approval is configured, verify that the request remains pending until an authorized certificate manager reviews the actual subject and SAN.

User certificate: certmgr.msc > Personal > Certificates > All Tasks > Request New Certificate
Computer certificate: certlm.msc > Personal > Certificates > All Tasks > Request New Certificate

❯ What to Verify

Approved requester: expected certificate or documented pending request.
Unapproved requester: no enrollment permission or issuance.

07

Roll Out and Review Existing Certificates

Closeout

After the pilot succeeds, move dependent applications in batches and monitor enrollment failures. Record the old template’s consumers and any issued certificates still in use; publishing a safer template does not invalidate old certificates. Retire the predecessor only through the PKI change process after replacement and revocation requirements are understood. Keep a rollback path for application enrollment, without reopening broad enrollment unnecessarily.

Closeout record: pilot results | old and new template names | issuing CAs |
                 dependent apps | certificate lifetime | rollback owner

❯ What to Verify

New requests use the approved template. Existing certificate treatment and
remaining application migrations are explicitly tracked.

Primary references

See Microsoft’s certificate template management guide, template concepts, CA administration and audit guidance, and insecure enrollment assessment.