AD-CFG-14 - Enrollment templates count should be retrievable
Overview
Enrollment templates represent which certificate templates are available for users/computers to request through AD-integrated enrollment. If unnecessary or risky templates are available for enrollment, an attacker may enroll for certificates that enable authentication, code-signing abuse, or access to privileged resources.
Security Recommendation
- Keep the enrollment template set minimal and aligned with your approved PKI strategy.
- Validate enrollment permissions and autoenrollment settings for each template that is enabled.
- Remove templates from enrollment that are not required for business operations.
- Monitor for unexpected changes to the number of enrollment templates.
How the Test Works
- Identifies enrollment-capable configuration in AD and enumerates enrollment templates exposed via that configuration.
- Counts the number of available enrollment templates.
- Compares the count to an environment baseline and flags unexpected increases (new template exposure) or decreases (possible misconfiguration/incident).
Related Tests
- Test-MtAdCertificateTemplatesCount: Broader view of templates defined in AD.
- Test-MtAdEnrollmentCaCertificateDetails: Ensures the CAs behind enrollment are healthy and not expired.
Test Metadata
| Field | Value |
|---|---|
| Test ID | AD-CFG-14 |
| Severity | Info |
| Suite | Active Directory |
| Category | AD.Config |
| PowerShell test | Test-MtAdEnrollmentTemplatesCount |
| Tags | AD, AD-CFG-14, AD.Config |
Source
- Pester test:
tests/ad/config/Test-MtAdEnrollmentTemplatesCount.Tests.ps1 - PowerShell source:
powershell/public/ad/config/Test-MtAdEnrollmentTemplatesCount.ps1