📒 Enabling ADCS Audit and Fix Bad Configs

Auditing is not enabled by default in AD CS. For some mysterious reason, Microsoft has decided to not enable AD CS auditing OOB.

To find the issue, run this command on every one of your CAs:

certutil -getreg CA\AuditFilter

To enable all auditing, do this:
certutil –setreg CA\AuditFilter 127
net stop certsvc
net start certsvc

You'll also need to enable the Certificate Service advanced auditing subcategories in a GPO linked to the OU containing your CA host objects (Figure 1). Lastly, enforce the advanced auditing subcategories! All of your previous work will be for naught if you don't enforce (Figure 2).

Fix for AD CS Templates with Bad Configs:
https://github.com/trimarcjake/adcs-snippets#fix-1-for-templates-with-bad-configs---remove-ability-to-set-a-san

#adcs #audit #recommendations #blueteam