Enterprise CA count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Certificate Services · All checks

Run this check

Invoke-Maester -TestId AD-CFG-12

Overview

Enterprise Certification Authorities (CAs) issue certificates for domain authentication and other PKI-dependent services. An unauthorized or newly introduced Enterprise CA can issue valid certificates that authenticate users/computers, enabling impersonation, man-in-the-middle attacks, and potential privilege escalation.

Control Type

Operational

Security Recommendation

• Maintain an allowlist of approved Enterprise CAs and treat CA additions as high-risk change events.
• Ensure only designated PKI administrators can create/modify CA objects.
• Validate CA certificate chains and revocation configuration after any CA change.
• Monitor and alert on deviations in the number of Enterprise CAs.

How the Test Works

• Enumerates Enterprise CA objects in Active Directory (enrollment-capable CA configuration objects).
• Counts how many Enterprise CAs are configured.
• Compares the observed count against the environment baseline and flags unexpected values.

Related Tests

• Test-MtAdEnrollmentCaCertificateDetails: Reviews CA certificate validity periods and integrity.
• Test-MtAdCertificateTemplatesCount: Ensures template exposure isn’t expanded beyond approved policies.
• Test-MtAdTrustedRootCaCount: Verifies trusted PKI trust anchors.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-12
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Certificate Services
Area	Infrastructure hardening
Resource type	CertificateAuthority
MITRE ATT&CK	None
PowerShell test	Test-MtAdEnterpriseCaCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-12.ps1
• Documentation: tests/ad/config/Test.AD-CFG-12.md