# Certificate templates count should be retrievable

Certificate templates define which certificate types can be issued and under what conditions.

Source: https://maester.dev/docs/tests/AD-CFG-13

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/soulemike" title="Michael Soule · Original author"><img src="https://github.com/soulemike.png" alt="Michael Soule" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/soulemike">Michael Soule</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/ad">Active Directory</a> · Active Directory · Certificate Services · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId AD-CFG-13
```

## Overview

Certificate templates define which certificate types can be issued and under what conditions. Overly permissive or unexpected templates can allow broader enrollment than intended, enabling privilege escalation through misconfigured enrollment permissions, risky EKUs, or unintended autoenrollment.

#### Control Type

**Operational**

#### Security Recommendation
- Establish and document the set of approved certificate templates for each CA.
- Review template permissions (who can enroll, who can manage) and enrollment constraints at least quarterly.
- Remove templates that are unused, deprecated, or risky (e.g., excessive EKUs, weak key protection settings, misconfigured subject name rules).
- Alert on unexpected additions/removals or unusual counts of templates.

#### How the Test Works
- Queries Active Directory for configured certificate template objects.
- Counts the total number of certificate templates present.
- Compares the observed count to an expected baseline and flags unexpected deviations.

#### Related Tests
- [Test-MtAdEnrollmentTemplatesCount](/docs/commands/Test-MtAdEnrollmentTemplatesCount): Assesses which templates are actually available for enrollment.
- [Test-MtAdEnterpriseCaCount](/docs/commands/Test-MtAdEnterpriseCaCount): Links template exposure to the CAs that can issue them.

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | AD-CFG-13 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Certificate Services |
| Area | Infrastructure hardening |
| Resource type | CertificateAuthority |
| MITRE ATT&CK | None |
| PowerShell test | [Test-MtAdCertificateTemplatesCount](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-13.ps1) |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:Configuration/*:ReadProperty |

</details>

## Source

- Test: [`tests/ad/config/Test.AD-CFG-13.ps1`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-13.ps1)
- Documentation: [`tests/ad/config/Test.AD-CFG-13.md`](https://github.com/maester365/maester/blob/main/tests/ad/config/Test.AD-CFG-13.md)