AD-CFG-15: Enrollment CA certificate details should be retrievable


ID	`AD-CFG-15`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Certificate Services
Security area	Infrastructure hardening
Resource type	CertificateAuthority
Reads from	On-premises Active Directory

What this checks and how to fix it

Enrollment-capable CA certificates include validity periods and other critical properties. Expired or invalid CA certificates can break certificate issuance and domain authentication flows. In addition, unexpected certificate replacements (e.g., unknown thumbprints) can indicate PKI tampering.

Control Type

Operational

Security Recommendation

Monitor CA certificate expiration and rotate certificates through an approved operational process.
Validate certificate thumbprints/subjects/issuers against your known-good CA configuration.
Alert when CA certificates are within your rotation window (commonly 30/60 days, depending on your policy).
Ensure CRL/OCSP and publication settings remain correct after certificate updates.

How the Test Works

Enumerates enrollment-capable CA objects in Active Directory.
Retrieves CA certificate details associated with those enrollment services.
Evaluates certificate validity (e.g., already expired, or expiring soon based on your configured thresholds) and highlights unexpected certificate identity details.

Test-MtAdEnterpriseCaCount: Helps confirm which CAs are expected to exist.
Test-MtAdTrustedRootCaCount: Validates the trust anchors that support issued certificates.

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).