AD-CFG-21: NTAuth certificates count should be retrievable
| ID | AD-CFG-21 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Certificate Services |
| Security area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”NTAuth certificates determine which Certification Authorities (CAs) are trusted to issue certificates for domain authentication scenarios (commonly smart card / certificate-based logon).
An increase in NTAuth certificates can mean additional CAs are now trusted—expanding the trust boundary and potentially enabling an attacker to obtain a certificate from an unintended CA.
Monitoring NTAuth certificate count helps detect:
- Unauthorized or accidental additions of NTAuth trust anchors
- Drift away from your approved CA list
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Treat the NTAuth store as security-critical: only add CAs that are explicitly approved.
- Review NTAuth changes immediately; require change ticket + CA validation before trusting new certificates.
- Remove any NTAuth certificates that are no longer required or are not in the approved CA list.
How the Test Works
Section titled “How the Test Works”The test queries the AD NTAuth certificate container, counts the number of configured NTAuth certificates, and outputs the result so you can track drift and investigate deviations.
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.