Trusted root CA details should be retrievable
Part of Active Directory · Active Directory · Certificate Services · All checks
Invoke-Maester -TestId AD-CFG-17Overview
Section titled “Overview”Trusted Root Certification Authorities (CAs) define which certificate chains are trusted for AD-integrated scenarios. If an unauthorized or misconfigured trusted root certificate is present, attackers may be able to mint certificates that validate in your environment.
This test focuses on the details of trusted root CAs, including certificate validity, to help detect:
- Expired root certificates that can break trust and authentication flows
- Unexpected/unauthorized root certificates that broaden your trust boundaries
Control Type
Section titled “Control Type”Operational
Security Recommendation
Section titled “Security Recommendation”- Verify each trusted root CA certificate matches your approved public key infrastructure (PKI) inventory.
- Remove (or revoke and clean up) any trusted root CA entries that are not explicitly authorized.
- Establish monitoring/alerting for certificates approaching expiration so you can renew before outages occur.
- If roots were added during maintenance, record change tickets and validate thumbprints/subjects.
How the Test Works
Section titled “How the Test Works”The test enumerates trusted root CA certificates configured for AD (or in the module’s AD configuration view), extracts identifying attributes (e.g., subject/issuer and thumbprint) and certificate validity dates, and reports which trusted roots are present and whether they are within their expected validity window.
Related Tests
Section titled “Related Tests”Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-CFG-17 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Certificate Services |
| Area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdTrustedRootCaDetails |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/config/Test.AD-CFG-17.ps1 - Documentation:
tests/ad/config/Test.AD-CFG-17.md