Active Directory Certificate Services (ADCS) have never really been under security scrutiny until a few years ago (by C. Falta and later Q&D Security). We will therefore focus today on how similar techniques can be used to gain Domain Admins privileges.

This article covers several AD Certificate Services settings that can easily be misconfigured, explains how to spot them and provides several options for further security hardening.