Control ID: CA-CONFIG-001
Control Name: CA Config Registry
Severity: High
Status: Success
Certificate Authority: securetron-lab-ISSUINGCA
Execution Time: 2025-10-15 22:42:50
Duration: 00:00:07.1186175

Expected Result:
Successful retrieval of CA registry configuration using certutil -getreg from remote CA using WMI/SMB or PowerShell remoting

Evidence:
PowerShell Remoting Method - Remote CertUtil Registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\securetron-lab-ISSUINGCA:

Keys:
  CSP
  EncryptionCSP
  ExitModules
  PolicyModules

Values:
  DSConfigDN               REG_SZ = CN=Configuration,DC=securetron-lab,DC=local
  DSDomainDN               REG_SZ = DC=securetron-lab,DC=local
  ViewAgeMinutes           REG_DWORD = 10 (16)
  ViewIdleMinutes          REG_DWORD = 8
  CAType                   REG_DWORD = 1
    ENUM_ENTERPRISE_SUBCA -- 1

  UseDS                    REG_DWORD = 1
  ForceTeletex             REG_DWORD = 12 (18)
    ENUM_TELETEX_AUTO -- 2
    ENUM_TELETEX_UTF8 -- 10 (16)

  SignedAttributes         REG_MULTI_SZ =
    0: RequesterName

  EKUOIDsForPublishExpiredCertInCRL REG_MULTI_SZ =
    0: 1.3.6.1.5.5.7.3.3 Code Signing
    1: 1.3.6.1.4.1.311.61.1.1 Kernel Mode Code Signing

  CommonName               REG_SZ = securetron-lab-ISSUINGCA

  Enabled                  REG_DWORD = 1
  PolicyFlags              REG_DWORD = 0
  CertEnrollCompatible     REG_DWORD = 0
  CRLEditFlags             REG_DWORD = 100 (256)
    EDITF_ENABLEAKIKEYID -- 100 (256)

  CRLFlags                 REG_DWORD = 2
    CRLF_DELETE_EXPIRED_CRLS -- 2

  InterfaceFlags           REG_DWORD = 641 (1601)
    IF_LOCKICERTREQUEST -- 1
    IF_NOREMOTEICERTADMINBACKUP -- 40 (64)
    IF_ENFORCEENCRYPTICERTREQUEST -- 200 (512)
    IF_ENFORCEENCRYPTICERTADMIN -- 400 (1024)

  EnforceX500NameLengths   REG_DWORD = 1
  SubjectTemplate          REG_MULTI_SZ =
    0: EMail
    1: CommonName
    2: OrganizationalUnit
    3: Organization
    4: Locality
    5: State
    6: DomainComponent
    7: Country

  ClockSkewMinutes         REG_DWORD = a (10)
  LogLevel                 REG_DWORD = 3

  HighSerial               REG_DWORD = 31 (49)
  CAServerName             REG_SZ = WIN-2FRMS42IJ4E.securetron-lab.local
  ValidityPeriod           REG_SZ = Years
  ValidityPeriodUnits      REG_DWORD = 2
  KRACertHash              REG_MULTI_SZ =

  KRACertCount             REG_DWORD = 0
  KRAFlags                 REG_DWORD = 0

  CRLPublicationURLs       REG_MULTI_SZ =
    0: 65:C:\WINDOWS\system32\CertSrv\CertEnroll\%3%8%9.crl
    CSURL_SERVERPUBLISH -- 1
    CSURL_SERVERPUBLISHDELTA -- 40 (64)

    1: 79:ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10
    CSURL_SERVERPUBLISH -- 1
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
    CSURL_ADDTOCRLCDP -- 8
    CSURL_SERVERPUBLISHDELTA -- 40 (64)

    2: 134:http://%1/CertEnroll/%3%8%9.crl
    CSURL_ADDTOCERTCDP -- 2
    CSURL_ADDTOFRESHESTCRL -- 4
    CSURL_ADDTOIDP -- 80 (128)

    3: 0:file://%1/CertEnroll/%3%8%9.crl


  CRLPeriod                REG_SZ = Weeks
  CRLPeriodUnits           REG_DWORD = 1

  CRLOverlapPeriod         REG_SZ = Hours
  CRLOverlapUnits          REG_DWORD = 0
  CRLDeltaPeriod           REG_SZ = Days
  CRLDeltaPeriodUnits      REG_DWORD = 1
  CRLDeltaOverlapPeriod    REG_SZ = Minutes

  CRLDeltaOverlapUnits     REG_DWORD = 0
  CAXchgValidityPeriod     REG_SZ = Weeks
  CAXchgValidityPeriodUnits REG_DWORD = 1
  CAXchgOverlapPeriod      REG_SZ = Days
  CAXchgOverlapPeriodUnits REG_DWORD = 1

  MaxIncomingMessageSize   REG_DWORD = 10000 (65536)
  MaxIncomingAllocSize     REG_DWORD = 10000 (65536)
  CACertPublicationURLs    REG_MULTI_SZ =
    0: 1:C:\WINDOWS\system32\CertSrv\CertEnroll\%1_%3%4.crt
    CSURL_SERVERPUBLISH -- 1

    1: 3:ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11
    CSURL_SERVERPUBLISH -- 1
    CSURL_ADDTOCERTCDP -- 2

    2: 0:http://%1/CertEnroll/%1_%3%4.crt

    3: 0:file://%1/CertEnroll/%1_%3%4.crt


  RequestFileName          REG_SZ = C:\%1_%3%4.req
  ParentCAMachine          REG_SZ = WIN-S5C68VEOUMN.securetron-lab.local

  ParentCAName             REG_SZ = Securetron-Lab-ROOT-CA
  CACertHash               REG_MULTI_SZ =
    0: 8c d7 5d 1e 83 d2 4d fd f3 c5 e4 45 36 50 af 3e 06 76 a1 62

  Security                 REG_BINARY =
    Allow CA Administrator	BUILTIN\Administrators
    Allow Certificate Manager	BUILTIN\Administrators
    Allow CA Administrator	SECURETRON-LAB\Domain Admins
    Allow Certificate Manager	SECURETRON-LAB\Domain Admins
    Allow CA Administrator	SECURETRON-LAB\Enterprise Admins
    Allow Certificate Manager	SECURETRON-LAB\Enterprise Admins
    Allow Enroll	NT AUTHORITY\Authenticated Users

  SetupStatus              REG_DWORD = 1
    SETUP_SERVER_FLAG -- 1

  CRLNextPublish           REG_BINARY = 10/5/2025 3:53 PM

  CRLDeltaNextPublish      REG_BINARY = 9/29/2025 3:53 PM
  AuditFilter              REG_DWORD = 7d (125)
  CAXchgCertHash           REG_MULTI_SZ =
    0: a0 5c 81 4a 49 b0 22 53 58 21 27 c1 76 08 ee 50 5d ef d0 12
CertUtil: -getreg command completed successfully.


Recommendation:
Registry configuration retrieved successfully. Review the output for any configuration issues.
