Posture check · Certificate Services
Certification authority objects controlled by non-administrators (T1649)
A principal outside the Tier 0 administrative set holds permissions over an enterprise certification authority object or the certificate configuration containers.
Why it matters
Whoever controls the certification authority can approve their own requests, publish a template, or issue a certificate for any account in the forest.
How GraphnAI finds it
It runs after every sync, across all your connected domains at once. It applies to Active Directory.
It reads:
- Certificate Services data
- The forest each domain belongs to
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
GraphnAI doesn't change certification authority permissions. Remove the delegated permissions in the Certification Authority console.
How to fix it
Remove the delegated permissions from the certification authority and the public key services containers, leaving only the Tier 0 administrative groups.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.