AD-CFG-14: Enrollment templates count should be retrievable


ID	`AD-CFG-14`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Certificate Services
Security area	Infrastructure hardening
Resource type	CertificateAuthority
Reads from	On-premises Active Directory

What this checks and how to fix it

Enrollment templates represent which certificate templates are available for users/computers to request through AD-integrated enrollment. If unnecessary or risky templates are available for enrollment, an attacker may enroll for certificates that enable authentication, code-signing abuse, or access to privileged resources.

Control Type

Operational

Security Recommendation

Keep the enrollment template set minimal and aligned with your approved PKI strategy.
Validate enrollment permissions and autoenrollment settings for each template that is enabled.
Remove templates from enrollment that are not required for business operations.
Monitor for unexpected changes to the number of enrollment templates.

How the Test Works

Identifies enrollment-capable configuration in AD and enumerates enrollment templates exposed via that configuration.
Counts the number of available enrollment templates.
Compares the count to an environment baseline and flags unexpected increases (new template exposure) or decreases (possible misconfiguration/incident).

Test-MtAdCertificateTemplatesCount: Broader view of templates defined in AD.
Test-MtAdEnrollmentCaCertificateDetails: Ensures the CAs behind enrollment are healthy and not expired.

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).