Security Notice: Documentation‑Guided Misconfiguration in Taglio PIVKey Smart Card Enrollment (AD CS ESC3)

This notice applies to a previous version of the following article:

Setting up Certificate Templates to Enroll on behalf of another user 

SpecterOps has made us aware of a potential misconfiguration risk in Active Directory Certificate Services (AD CS) when following incorrect guidance in the above article.
 

Specifically, the referenced article showed a screenshot for configuring Enrollment Agent templates in Microsoft AD CS that showed example security settings where the Enrollment Agent certificate template is configured with Enroll permission granted to “Authenticated Users.”

If implemented as shown, this configuration:

- Grants any authenticated domain user the ability to enroll for an Enrollment Agent certificate; and  
- Enables those users to perform Enroll On Behalf Of (EOBO) operations, allowing them to request certificates on behalf of arbitrary users, including highly privileged accounts (for example, Domain Admins, Enterprise Admins).

This misconfiguration aligns with the ESC3 class of AD CS vulnerabilities, in which a misconfigured Enrollment Agent / Certificate Request Agent template can be abused to obtain certificates for other principals and impersonate them, potentially leading to full domain or forest compromise.  More information on this vulnerability on the SpecterOps site:

Certified Pre-Owned - SpecterOps

Impact

An attacker who has valid domain credentials (any standard user) in an environment that follows this misconfiguration can:

1. Request an Enrollment Agent certificate using the Enrollment Agent template that grants Enroll to broad groups such as Authenticated Users.  
2. Use that Enrollment Agent certificate to request certificates on behalf of high-privilege accounts, including Domain Admins and Enterprise Admins.  
3. Use those forged certificates to authenticate as these privileged accounts (for example, via smart card logon / PKINIT), resulting in complete compromise of the Active Directory environment.

Organizations that have followed the example configuration exactly as shown are therefore at elevated risk of privilege escalation and domain compromise via this ESC3 pattern.
 

Recommended Action for Affected Organizations

If you have configured Enrollment Agent certificate templates following earlier documentation, we recommend performing the following steps as soon as possible:

1. Remove Authenticated Users from the template's security descriptor / discretionary access control list (DACL).  
  - On any Enrollment Agent certificate template, review the Security tab and ensure that Authenticated Users does not have Enroll (or Autoenroll) permissions.

2. Restrict Enroll permissions to a dedicated, least-privilege Enrollment Agent identity (group or account).  
  - Instead of granting Enroll to Authenticated Users, configure Enroll permissions only for a specific AD group or account that represents your legitimate Enrollment Agents (for example, a group such as "Enrollment Agents" or a tightly controlled helpdesk/enrollment operator group).  
 

3. Audit all certificates issued through Enrollment Agent templates for suspicious issuance patterns  
  - Review issued certificates where:  
    - The requestor and the target account differ, or  
    - The requestor is a low-privilege user requesting a certificate on behalf of a high-privilege account.  
  - Pay particular attention to certificates issued on behalf of Domain Admins, Enterprise Admins, or other highly privileged groups where the request originated from an unexpected or low-privilege user.

4. Revoke any suspicious or unauthorized certificates issued on behalf of privileged accounts  
  - For any certificates identified as suspicious or unauthorized in step 3, revoke them in the Certification Authority console.  
  - Ensure that CRLs or OCSP responses are updated and distributed so that revoked certificates cannot be used for authentication.

5. Implement additional controls such as requiring CA manager approval for Enrollment Agent certificate issuance  
  - On Enrollment Agent certificate templates, configure Issuance Requirements so that requests require CA certificate manager approval, and/or authorized signatures from trusted Enrollment Agents.  
  - This ensures that no Enrollment Agent certificates are automatically issued without explicit review and approval by a trusted CA administrator or designated approver.

Organizations should systematically review all existing Enrollment Agent certificates to identify and remediate any that were:

- Issued on behalf of accounts where the requestor and the target account differ, or  
- Issued where the requestor lacked explicit authorization to enroll on behalf of the target account.

For more information on the vulnerability
Certified Pre-Owned - SpecterOps