Posture check · Certificate Services
Certificate template where the requester chooses the subject (T1649)
A certificate template permits client authentication and allows the requester to supply the subject name, while enrollment is open to a broad set of principals.
Why it matters
Anyone who can enroll can request a certificate that names a domain administrator and authenticate as them. The certificate keeps working after a password reset.
How GraphnAI finds it
It runs after every sync, across all your connected domains at once. It applies to Active Directory.
It reads:
- Certificate Services data
- The forest each domain belongs to
Tiered Fidelity™ level: Theoretical
Every finding from this check carries the Theoretical level.
- TheoreticalThis checkConfigured in the directory. Nothing else checked.
- ConstrainedA constraint on it has been checked.
- ValidatedTelemetry has seen it in use.
Why there's no automatic fix
GraphnAI doesn't change certificate templates. Correct the template in the Certificate Templates console.
How to fix it
Remove the requester-supplied subject option from the template, or restrict enrollment to a narrow, reviewed set of principals and require manager approval.
Related checks
MITRE ATT&CK® technique names and MITRE D3FEND™ technique labels: © The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK® is a registered trademark and D3FEND™ a trademark of The MITRE Corporation.
See it on your own directory.
The Public Preview is free for 30 days from your first sync, on your own server.