AD-CFG-13: Certificate templates count should be retrievable
| ID | AD-CFG-13 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Certificate Services |
| Security area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Certificate templates define which certificate types can be issued and under what conditions. Overly permissive or unexpected templates can allow broader enrollment than intended, enabling privilege escalation through misconfigured enrollment permissions, risky EKUs, or unintended autoenrollment.
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Establish and document the set of approved certificate templates for each CA.
- Review template permissions (who can enroll, who can manage) and enrollment constraints at least quarterly.
- Remove templates that are unused, deprecated, or risky (e.g., excessive EKUs, weak key protection settings, misconfigured subject name rules).
- Alert on unexpected additions/removals or unusual counts of templates.
How the Test Works
Section titled “How the Test Works”- Queries Active Directory for configured certificate template objects.
- Counts the total number of certificate templates present.
- Compares the observed count to an expected baseline and flags unexpected deviations.
Related Tests
Section titled “Related Tests”Test-MtAdEnrollmentTemplatesCount: Assesses which templates are actually available for enrollment.Test-MtAdEnterpriseCaCount: Links template exposure to the CAs that can issue them.
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.