AD-CFG-16: Trusted root CA count should be retrievable
| ID | AD-CFG-16 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Certificate Services |
| Security area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Trusted root CAs act as the trust anchors for an entire PKI trust chain. If an attacker (or a misconfiguration) introduces an unauthorized trusted root CA, they may be able to construct certificates that validate through the trust chain, enabling broad compromise of authentication, TLS validation, and signed trust decisions.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Maintain an allowlist of trusted root CAs and require strong change control for trust additions/removals.
- Restrict permissions on PKI trust anchor configuration to only PKI administrators.
- After any change, verify certificate thumbprints/subjects, revocation publication, and distribution behavior.
- Alert on unexpected changes in the number of trusted root CAs.
How the Test Works
Section titled “How the Test Works”- Enumerates trusted root CA entries published in Active Directory (trust anchor objects).
- Counts the number of trusted root CAs.
- Compares the observed count to an environment baseline and flags unexpected increases/decreases.
Related Tests
Section titled “Related Tests”Test-MtAdEnrollmentCaCertificateDetails: Validates CA certificate validity and identity details.Test-MtAdEnterpriseCaCount: Confirms which CAs are configured for enrollment across the environment.
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.