Certificate Services (AD CS): ESC1, ESC3, ESC4, ESC5 and ESC13 Escalation Paths

Overview

Active Directory Certificate Services (AD CS) issues the certificates your users, computers and services authenticate with. A certification authority (CA) signs the certificates. A certificate template says who can ask for a certificate and what it allows. A template or CA with the wrong permissions lets an ordinary account request a certificate that names a domain administrator, then authenticate as them.

GraphnAI reads certificate services from your forest and draws them in the graph. Templates and enterprise CAs become nodes. Who can enroll (request a certificate) becomes a relationship. Where the settings add up to an attack, GraphnAI draws an escalation path from the account to each domain in the forest. You can open any path to see why it exists, simulate the fix, and watch two posture checks that cover the whole forest.

Every escalation path needs a CA that the forest trusts for authentication (the NTAuth store). A template that no trusted CA publishes can't be abused, so it has no path.

Prerequisites

• At least one Active Directory bridge in the forest, on a version that supports certificate services. A bridge on an older version shows Update needed.
• A sync account that can read the Public Key Services container in the forest's configuration. Authenticated users have this right by default.
• Reach analytics turned on, to compute escalation paths. Without it, the node panels say certificate paths aren't being computed.
• The Viewer role to see the data. Simulation needs Operator.

How collection works

You don't configure anything. GraphnAI reads certificate services once for each forest, not once for each domain.

1. GraphnAI picks one bridge and one domain in each forest as the collector. It prefers a bridge that already collects and is online. Otherwise it picks the first eligible bridge by name.
2. If the collector goes offline for more than 15 minutes, GraphnAI moves collection to another eligible bridge. A forest can have a collector on any of its domains, so no bridge has to sit on the forest root.
3. The collector reads the forest's certificate services on every sync, full and delta.
4. If two bridges report different forest names for the same domain, GraphnAI picks no collector and shows Forest unclear.

A failed read never deletes what GraphnAI already collected. The last good data stays until a read succeeds.

Check collection on the Bridges page

To check collection, open Bridges. The domain table has a Certificate services column. Hover over a label for the full sentence.

Step-by-step

Find certificate templates and certification authorities

1. Open Graph Explorer.
2. Search for a template or CA name, or filter by node type. Look for Certificate template and Enterprise certification authority.
3. Select the node to open its panel.

A certificate template panel shows:

An enterprise certification authority panel shows:

Select any listed account, group, template or CA to jump to it.

Read an escalation path

1. In Graph Explorer, select a dashed certificate relationship, or open a path from a template or CA panel.
2. The relationship panel opens with Why this path exists. It lists each condition that holds, such as "Requester chooses the subject name" and "No manager approval".
3. Below the list, Templates, Certification authorities and Containers link to the objects involved.

Two notes can appear under the list. "Granted to every account that authenticates. Shown from Domain Users and Domain Computers." means the right comes from Authenticated Users or Everyone. "Certification authority access assessed from the directory." means GraphnAI worked out CA access from directory permissions.

Find the host of a CA

A computer that hosts an enterprise CA is rated Tier 0, the same as a domain controller. Whoever controls that computer can forge certificates for any account. The CA node is rated Tier 0 too. See Asset Criticality Engine.

Check certificate posture

1. Open Risk Posture and select the Certificate Services category.
2. Read the two checks:
   • Certificate template where the requester chooses the subject fires for each template that lets the requester name the subject, allows authentication, needs no approval, and has broad enrollment.
   • Certification authority objects controlled by non-administrators fires for each CA object or certificate container that a principal outside Tier 0 can change.
3. If a forest can't be assessed, a notice appears above the findings. See When a forest can't be assessed.

Both checks cover the whole forest, however many bridges it has.

Simulate the fix

You need the Operator role.

1. Select an enrollment right (Can enroll) or an escalation path in Graph Explorer.
2. Select Simulate removing this access.
3. Read the result. It says "Removing this access also closes N certificate paths" when other paths depend on the same right. A path that another right or another CA still supports stays open.

You can simulate Can enroll and the escalation paths. The other structural relationships come from the directory as a whole, so they can't be simulated. Simulate removing an enrollment right instead.

Fix the cause

GraphnAI doesn't change certificate templates or CA permissions. Select Fire shows the reason instead of a fix.

• For a template, correct it in the Certificate Templates console.
• For a CA or its containers, remove the delegated permissions in the Certification Authority console.

After the change, the next sync reads the new settings and the path closes.

Relationships

Structural relationships

These describe how certificate services are wired. They aren't attacks and don't count as permissions in over-permission analytics. Reach doesn't follow them.

Escalation paths

Escalation paths are dashed and drawn in the attack-path style. Each one runs from an account to each domain in the forest, except Issuance policy group access, which ends at the linked group. Every path needs a CA the forest trusts for authentication, where the account can enroll.

A template that needs manager approval or an agent signature produces no path for its enrollers. The accounts that can switch the approval off get a Template control path.

Paths come from configuration and permissions, so they carry the Theoretical fidelity level.

When a forest can't be assessed

GraphnAI marks the two certificate checks Not assessed instead of passing them when it can't trust the data. A permission failure never reads as "no exposure". The notice above the findings says why.

A forest with no certificate services at all (no Public Key Services, or no enterprise certification authority) counts as assessed with nothing to check, so it never holds back the other forests' results. Data older than 72 hours counts as not assessed. If the status can't load, the page says "Couldn't load certificate services status. Retry, or open Platform Health."

Platform Health carries one warning for each forest that can't be assessed. It also warns when a permission names accounts GraphnAI couldn't find in the directory, or when a CA publishes templates that don't exist.

Configuration

Certificate services need no settings. Collection is elected and the posture checks run with the rest of posture. The only change you may need is directory access: give the sync account read access to Public Key Services in the forest's configuration, if your forest removed the default.

Reach analytics must be on for escalation paths. When it's off, the template and CA panels say "Certificate paths aren't being computed. Reach analytics is off." When the last run failed, counts show with "From the last successful run."

Limits

• GraphnAI doesn't read the CA's own enrollment restrictions, which live in the CA's registry and console. It assesses CA access from the directory, so the CA's own settings can be narrower. The panels say so.
• A CA that the forest trusts through another forest isn't covered yet.
• The ESC9 weak certificate mapping path isn't covered. Neither are ESC2, ESC6, ESC7 and ESC8.
• GraphnAI never changes templates or CA permissions.

Troubleshooting

The column says "Can't read"

The sync account can't read the Public Key Services container. Grant it read access in the forest's configuration, then wait for the next sync. The warning clears when a read succeeds.

Templates appear but an expected path is missing

Check the conditions in order. The template must be published on a CA that's Trusted for authentication. The account must be able to enroll on both the template and the CA. Manager approval or an agent signature removes the path.

The Certificate Services category says Not assessed

Read the notice above the findings and follow the matching row in When a forest can't be assessed.

A bridge shows "Update needed"

That bridge version can't collect certificate services. Update the bridge. If other bridges in the forest are current, one of them collects.

A CA's host computer says "Host computer not found in the directory"

The CA's DNS name matches no single computer in the forest. Check the CA's DNS host name in the Certification Authority console and make sure the computer is synced.

Escalation path counts are missing

Reach analytics is off, or hasn't run yet. Turn it on and wait for the next computation.