Trusted root CA count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Certificate Services · All checks

Run this check

Invoke-Maester -TestId AD-CFG-16

Overview

Trusted root CAs act as the trust anchors for an entire PKI trust chain. If an attacker (or a misconfiguration) introduces an unauthorized trusted root CA, they may be able to construct certificates that validate through the trust chain, enabling broad compromise of authentication, TLS validation, and signed trust decisions.

Control Type

Operational

Security Recommendation

• Maintain an allowlist of trusted root CAs and require strong change control for trust additions/removals.
• Restrict permissions on PKI trust anchor configuration to only PKI administrators.
• After any change, verify certificate thumbprints/subjects, revocation publication, and distribution behavior.
• Alert on unexpected changes in the number of trusted root CAs.

How the Test Works

• Enumerates trusted root CA entries published in Active Directory (trust anchor objects).
• Counts the number of trusted root CAs.
• Compares the observed count to an environment baseline and flags unexpected increases/decreases.

Related Tests

• Test-MtAdEnrollmentCaCertificateDetails: Validates CA certificate validity and identity details.
• Test-MtAdEnterpriseCaCount: Confirms which CAs are configured for enrollment across the environment.

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-16
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Certificate Services
Area	Infrastructure hardening
Resource type	CertificateAuthority
MITRE ATT&CK	None
PowerShell test	Test-MtAdTrustedRootCaCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-16.ps1
• Documentation: tests/ad/config/Test.AD-CFG-16.md