Control ID: CA-CONFIG-001
Control Name: CA Config Registry
Severity: High
Status: Success
Certificate Authority: Securetron-Lab-ROOT-CA
Execution Time: 2025-10-15 22:42:26
Duration: 00:00:07.5627431

Expected Result:
Successful retrieval of CA registry configuration using certutil -getreg from remote CA using WMI/SMB or PowerShell remoting

Evidence:
PowerShell Remoting Method - Remote CertUtil Registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\Securetron-Lab-ROOT-CA:

Keys:
  CSP
  EncryptionCSP
  ExitModules
  PolicyModules

Values:
  DSConfigDN               REG_SZ = CN=Configuration,DC=securetron-lab,DC=local
  DSDomainDN               REG_SZ = DC=securetron-lab,DC=local
  ViewAgeMinutes           REG_DWORD = 10 (16)
  ViewIdleMinutes          REG_DWORD = 8
  CAType                   REG_DWORD = 0
    ENUM_ENTERPRISE_ROOTCA -- 0

  UseDS                    REG_DWORD = 1
  ForceTeletex             REG_DWORD = 12 (18)
    ENUM_TELETEX_AUTO -- 2
    ENUM_TELETEX_UTF8 -- 10 (16)

  SignedAttributes         REG_MULTI_SZ =
    0: RequesterName

  EKUOIDsForPublishExpiredCertInCRL REG_MULTI_SZ =
    0: 1.3.6.1.5.5.7.3.3 Code Signing
    1: 1.3.6.1.4.1.311.61.1.1 Kernel Mode Code Signing

  CommonName               REG_SZ = Securetron-Lab-ROOT-CA

  Enabled                  REG_DWORD = 1
  PolicyFlags              REG_DWORD = 0
  CertEnrollCompatible     REG_DWORD = 0
  CRLEditFlags             REG_DWORD = 100 (256)
    EDITF_ENABLEAKIKEYID -- 100 (256)

  CRLFlags                 REG_DWORD = 2
    CRLF_DELETE_EXPIRED_CRLS -- 2

  InterfaceFlags           REG_DWORD = 641 (1601)
    IF_LOCKICERTREQUEST -- 1
    IF_NOREMOTEICERTADMINBACKUP -- 40 (64)
    IF_ENFORCEENCRYPTICERTREQUEST -- 200 (512)
    IF_ENFORCEENCRYPTICERTADMIN -- 400 (1024)

  EnforceX500NameLengths   REG_DWORD = 1
  SubjectTemplate          REG_MULTI_SZ =
    0: EMail
    1: CommonName
    2: OrganizationalUnit
    3: Organization
    4: Locality
    5: State
    6: DomainComponent
    7: Country

  ClockSkewMinutes         REG_DWORD = a (10)
  LogLevel                 REG_DWORD = 3

  HighSerial               REG_DWORD = 30 (48)
  CAServerName             REG_SZ = WIN-S5C68VEOUMN.securetron-lab.local
  ValidityPeriod           REG_SZ = Years
  ValidityPeriodUnits      REG_DWORD = 2
  KRACertHash              REG_MULTI_SZ =

  KRACertCount             REG_DWORD = 0
  KRAFlags                 REG_DWORD = 0

  CRLPublicationURLs       REG_MULTI_SZ =
    0: 65:C:\WINDOWS\system32\CertSrv\CertEnroll\%3%8%9.crl
    CSURL_SERVERPUBLISH -- 1
    CSURL_SERVERPUBLISHDELTA -- 40 (64)

    1: 79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10
    CSURL_SERVERPUBLISH -- 1
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
    CSURL_ADDTOCRLCDP -- 8
    CSURL_SERVERPUBLISHDELTA -- 40 (64)

    2: 0:http://%1/CertEnroll/%3%8%9.crl

    3: 0:file://%1/CertEnroll/%3%8%9.crl

    4: 134:http://web.securetron-lab.local/%3%8%9.crl
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
    CSURL_ADDTOIDP -- 80 (128)

    5: 134:http://localhost/%3%8%9.crl
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
    CSURL_ADDTOIDP -- 80 (128)

    6: 134:http://192.168.205.128/%3%8%9.crl
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
    CSURL_ADDTOIDP -- 80 (128)


  CRLPeriod                REG_SZ = Weeks
  CRLPeriodUnits           REG_DWORD = 1

  CRLOverlapPeriod         REG_SZ = Hours
  CRLOverlapUnits          REG_DWORD = 0
  CRLDeltaPeriod           REG_SZ = Days
  CRLDeltaPeriodUnits      REG_DWORD = 1
  CRLDeltaOverlapPeriod    REG_SZ = Minutes

  CRLDeltaOverlapUnits     REG_DWORD = 0
  CAXchgValidityPeriod     REG_SZ = Weeks
  CAXchgValidityPeriodUnits REG_DWORD = 1
  CAXchgOverlapPeriod      REG_SZ = Days
  CAXchgOverlapPeriodUnits REG_DWORD = 1

  MaxIncomingMessageSize   REG_DWORD = 10000 (65536)
  MaxIncomingAllocSize     REG_DWORD = 10000 (65536)
  CACertPublicationURLs    REG_MULTI_SZ =
    0: 1:C:\WINDOWS\system32\CertSrv\CertEnroll\%1_%3%4.crt
    CSURL_SERVERPUBLISH -- 1

    1: 3:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11
    CSURL_SERVERPUBLISH -- 1
    CSURL_ADDTOCERTCDP -- 2

    2: 0:file://%1/CertEnroll/%1_%3%4.crt

    3: 0:http://web.securetron-lab/%1_%3%4.crt

    4: 34:http://192.168.205.128/%1_%3%4.crt
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOCERTOCSP -- 20 (32)


  CACertHash               REG_MULTI_SZ =
    0: d2 27 ea c5 07 61 6d 5a 94 8e b0 59 76 5e ac 07 af 9e 65 3b

  Security                 REG_BINARY =
    Allow Read Enroll	NT AUTHORITY\Authenticated Users
    Allow Enroll	NT AUTHORITY\Authenticated Users
    Allow CA Administrator Certificate Manager Read Enroll	SECURETRON-LAB\WIN-S5C68VEOUMN$
    Allow CA Administrator Certificate Manager	SECURETRON-LAB\Domain Admins
    Allow CA Administrator Certificate Manager Read Enroll	SECURETRON-LAB\Domain Admins
    Allow CA Administrator Certificate Manager	SECURETRON-LAB\Enterprise Admins
    Allow CA Administrator Certificate Manager Read Enroll	SECURETRON-LAB\Enterprise Admins
    Allow CA Administrator Certificate Manager Read Enroll	BUILTIN\Administrators
    Allow CA Administrator Certificate Manager	BUILTIN\Administrators


  SetupStatus              REG_DWORD = 1
    SETUP_SERVER_FLAG -- 1

  CRLNextPublish           REG_BINARY = 10/22/2025 6:26 AM
  CRLDeltaNextPublish      REG_BINARY = 10/16/2025 6:26 AM
  AuditFilter              REG_DWORD = 7c (124)
  CAXchgCertHash           REG_MULTI_SZ =
    0: 0c f7 ef 60 b5 30 c4 a9 f1 d1 03 b0 c7 f4 2a 02 f9 e4 fe 0f
CertUtil: -getreg command completed successfully.


Recommendation:
Registry configuration retrieved successfully. Review the output for any configuration issues.
