> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/03.-adcs-overview.md).

# 03. ADCS Overview

**What it is:** ADCS is Microsoft's built-in Public Key Infrastructure (PKI). It runs a Certificate Authority (CA) that issues X.509 certificates for things like smart-card logon, HTTPS, code signing, and — critically — **domain authentication**. A certificate with the right properties can be used exactly like a password or Kerberos ticket to log in as a user.

## Why Attackers Love It

ADCS permissions are governed by a completely separate system from normal AD object DACLs — **certificate templates**, each with its own settings for:

* Who is allowed to **enroll** (request a certificate from it)
* What **Extended Key Usages (EKUs)** the resulting cert has (e.g. Client Authentication)
* Whether the **requester** or the **template** decides what identity the certificate represents

Because this is a separate, often-overlooked permission layer, it's extremely common to find templates that are more permissive than anyone intended. The security community catalogued these misconfiguration patterns as **ESC1 through ESC16** ("Enrollment Service Compromise").

## The Enumeration Tool of Choice — Certipy

```bash
certipy find -u jane.doe@domain.htb -k -no-pass -dc-ip 10.10.10.5 \
  -target dc1.domain.htb -vulnerable -stdout
```

This flags templates with known-dangerous configurations automatically, rather than requiring you to manually inspect every attribute.

## Key Terms

| Term           | Definition                                                                                     |
| -------------- | ---------------------------------------------------------------------------------------------- |
| **ADCS**       | Active Directory Certificate Services — Microsoft's PKI                                        |
| **CA**         | Certificate Authority — the ADCS component that actually issues certificates                   |
| **Template**   | A reusable configuration profile a CA uses to issue a specific kind of certificate             |
| **EKU**        | Extended Key Usage — what a certificate is allowed to be used for (e.g. Client Authentication) |
| **ESC1–ESC16** | Named catalogue of common ADCS misconfiguration patterns                                       |

This file is the foundation for two specific attacks covered separately: `04_ESC13.md` and `11_ESC1.md`.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/active-directory/03.-adcs-overview.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.