AD-CFG-12: Enterprise CA count should be retrievable


ID	`AD-CFG-12`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Certificate Services
Security area	Infrastructure hardening
Resource type	CertificateAuthority
Reads from	On-premises Active Directory

What this checks and how to fix it

Enterprise Certification Authorities (CAs) issue certificates for domain authentication and other PKI-dependent services. An unauthorized or newly introduced Enterprise CA can issue valid certificates that authenticate users/computers, enabling impersonation, man-in-the-middle attacks, and potential privilege escalation.

Control Type

Operational

Security Recommendation

Maintain an allowlist of approved Enterprise CAs and treat CA additions as high-risk change events.
Ensure only designated PKI administrators can create/modify CA objects.
Validate CA certificate chains and revocation configuration after any CA change.
Monitor and alert on deviations in the number of Enterprise CAs.

How the Test Works

Enumerates Enterprise CA objects in Active Directory (enrollment-capable CA configuration objects).
Counts how many Enterprise CAs are configured.
Compares the observed count against the environment baseline and flags unexpected values.

Test-MtAdEnrollmentCaCertificateDetails: Reviews CA certificate validity periods and integrity.
Test-MtAdCertificateTemplatesCount: Ensures template exposure isn’t expanded beyond approved policies.
Test-MtAdTrustedRootCaCount: Verifies trusted PKI trust anchors.

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).