[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-283485-105":53,"doc-detail-283485-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","certified-pre-owned-version-101-revision-summary","Certified Pre-Owned - Version 1.0.1 - Revision Summary","","Microsoft’s Active Directory Public Key Infrastructure (PKI) implementation, known as Active Directory Certificate Services (AD CS), often remains under-recognized by both attackers and defenders. AD CS is widely deployed and enables credential theft, machine persistence, domain escalation, and subtle domain persistence. The work explains certificate fundamentals in Active Directory, details AD CS abuse via certificate theft and malicious enrollment for user and machine persistence, and covers misconfigurations leading to escalation. It also describes stealing a Certificate Authority private key to forge new “golden” certificates and provides defensive, detective, and incident-response guidance.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/certified-pre-owned-version-101-revision-summary/283485/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/certified-pre-owned-version-101-revision-summary/283485.png","ImageObject",442,249,{"name":88,"@type":89},"Eden","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-11-04","2026-09-17",true,{"@type":98,"interactionType":99,"userInteractionCount":20},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What is AD CS in Microsoft Active Directory environments?","Question",{"text":108,"@type":109},"AD CS is Microsoft’s PKI implementation integrated with Active Directory forests, providing capabilities such as digital signatures and user authentication. It is not installed by default, but it is widely deployed in real environments.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How can attackers abuse AD CS for credential theft and persistence?",{"text":113,"@type":109},"AD CS can be abused through certificate theft and active malicious enrollments that support user and machine persistence. This can further enable credential compromise and long-term access.",{"name":115,"@type":106,"acceptedAnswer":116},"Which AD CS issues can lead to domain escalation and how are they addressed defensively?",{"text":117,"@type":109},"Common misconfigurations can enable domain escalation, including problems related to certificate authority and architecture. The document provides preventive, detective, and incident-response guidance, along with defensive gaps and challenges.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},283485,1791720337,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":20,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":32},1374391974468,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Certified Pre-Owned  \nAbusing Active Directory Certificate Services  \nWill Schroeder Lee Christensen  \nVersion 1.0.1  \nRevision Summary  \n\n| Date | Version | Description |\n| --- | --- | --- |\n| 2021-06-22 | 1.0.1 | Updated EKU details for ESC1 and ESC2 . |\n| 2021-06-17 | 1.0.0 | Initial release. |\n\nTABLE OF CONTENTS  \nABSTRACT .............................................................................................................................................................. 1  \nINTRODUCTION ..................................................................................................................................................... 2  \nPRIOR WORK ......................................................................................................................................................... 8  \nBACKGROUND ..................................................................................................................................................... 12  \nCERTIFICATE TEMPLATES ............................................................................................................................................... 16  \nCERTIFICATE ENROLLMENT............................................................................................................................................. 19  \nSUBJECT ALTERNATIVE NAMES AND AUTHENTICATION ........................................................................................................29  \nAD CS ENUMERATION ..................................................................................................................................................34  \nAD CS TRADECRAFT ............................................................................................................................................. 38  \nCERTIFICATE THEFT ......................................................................................................................................................38  \nACCOUNT PERSISTENCE.................................................................................................................................................49  \nDOMAIN ESCALATION ...................................................................................................................................................54  \nDOMAIN PERSISTENCE ..................................................................................................................................................82  \nPKI ARCHITECTURE FLAWS................................................................................................................................... 92  \nLACK OF OFFLINE ROOT CA AND TIERED ARCHITECTURE......................................................................................................92  \nUNPROTECTED SUBORDINATE CAS ..................................................................................................................................93  \nBREAKING FOREST TRUSTS VIA AD CS .............................................................................................................................94  \nDEFENSIVE GUIDANCE ......................................................................................................................................... 97  \nPREVENTIVE GUIDANCE.................................................................................................................................................97  \nDETECTIVE GUIDANCE.................................................................................................................................................115  \nINCIDENT RESPONSE GUIDANCE ....................................................................................................................................136  \nDEFENSIVE GAPS AND CHALLENGES ...............................................................................................................................137  \nCONCLUSION ...................","cbCaitcIag5eYjxB","https://ap.wps.com/l/cbCaitcIag5eYjxB","pdf",10406101,143,"English","# Abstract\n# Introduction\n# Prior Work\n# Background\n# Certificate Templates\n# Certificate Enrollment\n# Subject Alternative Names and Authentication\n# AD CS Enumeration\n# AD CS Tradecraft\n## Certificate Theft\n## Account Persistence\n## Domain Escalation\n## Domain Persistence\n# PKI Architecture Flaws\n## Lack of Offline Root CA and Tiered Architecture\n## Unprotected Subordinate CAs\n## Breaking Forest Trusts via AD CS\n# Defensive Guidance\n## Preventive Guidance\n## Detective Guidance\n## Incident Response Guidance\n# Defensive Gaps and Challenges\n# Conclusion\n# Acknowledgements","[{\"question\":\"What is AD CS in Microsoft Active Directory environments?\",\"answer\":\"AD CS is Microsoft’s PKI implementation integrated with Active Directory forests, providing capabilities such as digital signatures and user authentication. It is not installed by default, but it is widely deployed in real environments.\"},{\"question\":\"How can attackers abuse AD CS for credential theft and persistence?\",\"answer\":\"AD CS can be abused through certificate theft and active malicious enrollments that support user and machine persistence. This can further enable credential compromise and long-term access.\"},{\"question\":\"Which AD CS issues can lead to domain escalation and how are they addressed defensively?\",\"answer\":\"Common misconfigurations can enable domain escalation, including problems related to certificate authority and architecture. The document provides preventive, detective, and incident-response guidance, along with defensive gaps and challenges.\"}]","Certified Pre-Owned - Version 1.0.1 - Revision Summary | PDF",1789609193]