Certificate templates count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Certificate Services · All checks

Run this check

Invoke-Maester -TestId AD-CFG-13

Overview

Certificate templates define which certificate types can be issued and under what conditions. Overly permissive or unexpected templates can allow broader enrollment than intended, enabling privilege escalation through misconfigured enrollment permissions, risky EKUs, or unintended autoenrollment.

Control Type

Operational

Security Recommendation

• Establish and document the set of approved certificate templates for each CA.
• Review template permissions (who can enroll, who can manage) and enrollment constraints at least quarterly.
• Remove templates that are unused, deprecated, or risky (e.g., excessive EKUs, weak key protection settings, misconfigured subject name rules).
• Alert on unexpected additions/removals or unusual counts of templates.

How the Test Works

• Queries Active Directory for configured certificate template objects.
• Counts the total number of certificate templates present.
• Compares the observed count to an expected baseline and flags unexpected deviations.

Related Tests

• Test-MtAdEnrollmentTemplatesCount: Assesses which templates are actually available for enrollment.
• Test-MtAdEnterpriseCaCount: Links template exposure to the CAs that can issue them.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-13
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Certificate Services
Area	Infrastructure hardening
Resource type	CertificateAuthority
MITRE ATT&CK	None
PowerShell test	Test-MtAdCertificateTemplatesCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-13.ps1
• Documentation: tests/ad/config/Test.AD-CFG-13.md