Intermediate CA count should be retrievable

Contributed by Michael SouleAll contributors →

Part of Active Directory · Active Directory · Certificate Services · All checks

Run this check

Invoke-Maester -TestId AD-CFG-18

Overview

Intermediate Certification Authorities (CAs) sit between root CAs and end-entity certificates. They influence which certificate chains can be built for authentication and other PKI-backed operations.

A sudden change in the number of intermediate CAs can indicate:

• Unauthorized issuance paths being introduced
• Configuration drift from expected PKI baselines
• Incomplete/incorrect CA role deployment after PKI changes

Monitoring the count helps you detect unexpected additions/removals quickly, before they result in trust failures or broadened trust.

Control Type

Operational

Security Recommendation

• Maintain an approved list of intermediate CA thumbprints/subjects and treat deviations as security-relevant events.
• Investigate and remediate any intermediate CA entries that were not deployed through your change management process.
• Use this count as an early indicator before running deeper CA detail validation tests.

How the Test Works

The test queries AD configuration for intermediate CA entries and returns the number of intermediate CAs currently present. This provides a baseline for expected PKI hierarchy structure and change detection.

Related Tests

• Test-MtAdIntermediateCaDetails

Details

Every attribute of this check

Field	Value
Test ID	AD-CFG-18
Severity	Info
Suite	Active Directory
Product	Active Directory
Feature	Certificate Services
Area	Infrastructure hardening
Resource type	CertificateAuthority
MITRE ATT&CK	None
PowerShell test	Test-MtAdIntermediateCaCount
Services	ActiveDirectory
Permissions	ActiveDirectory:Ldap:Configuration/*:ReadProperty

Source

• Test: tests/ad/config/Test.AD-CFG-18.ps1
• Documentation: tests/ad/config/Test.AD-CFG-18.md