Enrollment CA certificate details should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Certificate Services · All checks

Run this check

Invoke-Maester -TestId AD-CFG-15

Overview

Enrollment-capable CA certificates include validity periods and other critical properties. Expired or invalid CA certificates can break certificate issuance and domain authentication flows. In addition, unexpected certificate replacements (e.g., unknown thumbprints) can indicate PKI tampering.

Control Type

Operational

Security Recommendation

• Monitor CA certificate expiration and rotate certificates through an approved operational process.
• Validate certificate thumbprints/subjects/issuers against your known-good CA configuration.
• Alert when CA certificates are within your rotation window (commonly 30/60 days, depending on your policy).
• Ensure CRL/OCSP and publication settings remain correct after certificate updates.

How the Test Works

• Enumerates enrollment-capable CA objects in Active Directory.
• Retrieves CA certificate details associated with those enrollment services.
• Evaluates certificate validity (e.g., already expired, or expiring soon based on your configured thresholds) and highlights unexpected certificate identity details.

Related Tests

• Test-MtAdEnterpriseCaCount: Helps confirm which CAs are expected to exist.
• Test-MtAdTrustedRootCaCount: Validates the trust anchors that support issued certificates.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-15
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Certificate Services
Area	Infrastructure hardening
Resource type	CertificateAuthority
MITRE ATT&CK	None
PowerShell test	Test-MtAdEnrollmentCaCertificateDetails
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-15.ps1
• Documentation: tests/ad/config/Test.AD-CFG-15.md