Control ID: CA-CONFIG-002
Control Name: CA Templates
Severity: High
Status: Success
Certificate Authority: securetron-lab-ISSUINGCA
Execution Time: 2025-10-15 22:42:58
Duration: 00:00:00.3924962

Expected Result:
Successful retrieval of CA templates using certutil -CATemplates -v -config securetron-lab-ISSUINGCA

Evidence:
DirectoryEmailReplication: Directory Email Replication -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 29 (41)
    CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = 9000000 (150994944)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID -- 1000000 (16777216)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  msPKI-Private-Key-Flag = 0
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 10060 (65632)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = DirectoryEmailReplication
  distinguishedName = DirectoryEmailReplication
  displayName = Directory Email Replication
  templateDescription = Directory e-mail replication
  pKIExtendedKeyUsage = 1.3.6.1.4.1.311.21.19 Directory Service Email Replication
  pKIDefaultCSPs = Microsoft RSA SChannel Cryptographic Provider
  pKICriticalExtensions =
    0: 2.5.29.15 Key Usage
    1: 2.5.29.17 Subject Alternative Name
  revision = 73 (115)
  msPKI-Template-Schema-Version = 2
  msPKI-Template-Minor-Revision = 0
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.29 Directory Email Replication
  msPKI-Supersede-Templates = DomainController
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy = 1.3.6.1.4.1.311.21.19 Directory Service Email Replication
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-498)(OA;;RPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;S-1-5-21-1498873929-1015914979-173946537-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 18 02 00 00  34 02 00 00 00 00 00 00   ........4.......
        0010	14 00 00 00 04 00 04 02  0b 00 00 00 05 00 38 00   ..............8.
        0020	10 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   ........h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	f2 01 00 00 05 00 38 00  10 01 00 00 01 00 00 00   ......8.........
        0060	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  f2 01 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        00d0	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        00e0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        00f0	e3 a1 8d 3c a9 36 5e 0a  04 02 00 00 05 00 38 00   ...<.6^.......8.
        0100	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0110	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0120	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0130	07 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0140	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        0150	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0160	e3 a1 8d 3c a9 36 5e 0a  04 02 00 00 05 00 28 00   ...<.6^.......(.
        0170	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0180	90 d4 00 c0 4f 79 dc 55  01 01 00 00 00 00 00 05   ....Oy.U........
        0190	09 00 00 00 05 00 28 00  30 01 00 00 01 00 00 00   ......(.0.......
        01a0	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        01b0	01 01 00 00 00 00 00 05  09 00 00 00 00 00 24 00   ..............$.
        01c0	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        01d0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        01e0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        01f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0200	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        0210	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        0220	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0230	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0240	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 4
    1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
    Certificate Template Information
        Template=Directory Email Replication(1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.29)
        Major Version Number=115
        Minor Version Number=0

    2.5.29.37: Flags = 0, Length = d
    Enhanced Key Usage
        Directory Service Email Replication (1.3.6.1.4.1.311.21.19)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

    1.3.6.1.4.1.311.21.10: Flags = 0, Length = f
    Application Policies
        [1]Application Certificate Policy:
             Policy Identifier=Directory Service Email Replication

DomainControllerAuthentication: Domain Controller Authentication -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 20 (32)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = 8000000 (134217728)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  msPKI-Private-Key-Flag = 0
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 10060 (65632)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = DomainControllerAuthentication
  distinguishedName = DomainControllerAuthentication
  displayName = Domain Controller Authentication
  templateDescription = Computer
  pKIExtendedKeyUsage =
    0: 1.3.6.1.5.5.7.3.2 Client Authentication
    1: 1.3.6.1.5.5.7.3.1 Server Authentication
    2: 1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  pKIDefaultCSPs = Microsoft RSA SChannel Cryptographic Provider
  pKICriticalExtensions =
    0: 2.5.29.15 Key Usage
    1: 2.5.29.17 Subject Alternative Name
  revision = 6e (110)
  msPKI-Template-Schema-Version = 2
  msPKI-Template-Minor-Revision = 0
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.28 Domain Controller Authentication
  msPKI-Supersede-Templates = DomainController
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
    0: 1.3.6.1.5.5.7.3.2 Client Authentication
    1: 1.3.6.1.5.5.7.3.1 Server Authentication
    2: 1.3.6.1.4.1.311.20.2.2 Smart Card Logon
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-498)(OA;;RPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;S-1-5-21-1498873929-1015914979-173946537-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 18 02 00 00  34 02 00 00 00 00 00 00   ........4.......
        0010	14 00 00 00 04 00 04 02  0b 00 00 00 05 00 38 00   ..............8.
        0020	10 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   ........h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	f2 01 00 00 05 00 38 00  10 01 00 00 01 00 00 00   ......8.........
        0060	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  f2 01 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        00d0	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        00e0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        00f0	e3 a1 8d 3c a9 36 5e 0a  04 02 00 00 05 00 38 00   ...<.6^.......8.
        0100	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0110	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0120	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0130	07 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0140	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        0150	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0160	e3 a1 8d 3c a9 36 5e 0a  04 02 00 00 05 00 28 00   ...<.6^.......(.
        0170	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0180	90 d4 00 c0 4f 79 dc 55  01 01 00 00 00 00 00 05   ....Oy.U........
        0190	09 00 00 00 05 00 28 00  30 01 00 00 01 00 00 00   ......(.0.......
        01a0	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        01b0	01 01 00 00 00 00 00 05  09 00 00 00 00 00 24 00   ..............$.
        01c0	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        01d0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        01e0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        01f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0200	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        0210	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        0220	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0230	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0240	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 4
    1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
    Certificate Template Information
        Template=Domain Controller Authentication(1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.28)
        Major Version Number=110
        Minor Version Number=0

    2.5.29.37: Flags = 0, Length = 22
    Enhanced Key Usage
        Client Authentication (1.3.6.1.5.5.7.3.2)
        Server Authentication (1.3.6.1.5.5.7.3.1)
        Smart Card Logon (1.3.6.1.4.1.311.20.2.2)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

    1.3.6.1.4.1.311.21.10: Flags = 0, Length = 28
    Application Policies
        [1]Application Certificate Policy:
             Policy Identifier=Client Authentication
        [2]Application Certificate Policy:
             Policy Identifier=Server Authentication
        [3]Application Certificate Policy:
             Policy Identifier=Smart Card Logon

KerberosAuthentication: Kerberos Authentication -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 20 (32)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = 8400000 (138412032)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DOMAIN_DNS -- 400000 (4194304)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
  msPKI-Private-Key-Flag = 0
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 10060 (65632)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = KerberosAuthentication
  distinguishedName = KerberosAuthentication
  displayName = Kerberos Authentication
  templateDescription = Computer
  pKIExtendedKeyUsage =
    0: 1.3.6.1.5.5.7.3.2 Client Authentication
    1: 1.3.6.1.5.5.7.3.1 Server Authentication
    2: 1.3.6.1.4.1.311.20.2.2 Smart Card Logon
    3: 1.3.6.1.5.2.3.5 KDC Authentication
  pKIDefaultCSPs = Microsoft RSA SChannel Cryptographic Provider
  pKICriticalExtensions =
    0: 2.5.29.15 Key Usage
    1: 2.5.29.17 Subject Alternative Name
  revision = 6e (110)
  msPKI-Template-Schema-Version = 2
  msPKI-Template-Minor-Revision = 0
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.33 Kerberos Authentication
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
    0: 1.3.6.1.5.5.7.3.2 Client Authentication
    1: 1.3.6.1.5.5.7.3.1 Server Authentication
    2: 1.3.6.1.4.1.311.20.2.2 Smart Card Logon
    3: 1.3.6.1.5.2.3.5 KDC Authentication
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-498)(OA;;RPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;S-1-5-21-1498873929-1015914979-173946537-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(OA;;RPWPCR;a05b8cc2-17bc-4802-a710-e7c15ab866a2;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 18 02 00 00  34 02 00 00 00 00 00 00   ........4.......
        0010	14 00 00 00 04 00 04 02  0b 00 00 00 05 00 38 00   ..............8.
        0020	10 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   ........h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	f2 01 00 00 05 00 38 00  10 01 00 00 01 00 00 00   ......8.........
        0060	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  f2 01 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        00d0	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        00e0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        00f0	e3 a1 8d 3c a9 36 5e 0a  04 02 00 00 05 00 38 00   ...<.6^.......8.
        0100	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0110	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0120	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0130	07 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0140	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        0150	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0160	e3 a1 8d 3c a9 36 5e 0a  04 02 00 00 05 00 28 00   ...<.6^.......(.
        0170	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0180	90 d4 00 c0 4f 79 dc 55  01 01 00 00 00 00 00 05   ....Oy.U........
        0190	09 00 00 00 05 00 28 00  30 01 00 00 01 00 00 00   ......(.0.......
        01a0	c2 8c 5b a0 bc 17 02 48  a7 10 e7 c1 5a b8 66 a2   ..[....H....Z.f.
        01b0	01 01 00 00 00 00 00 05  09 00 00 00 00 00 24 00   ..............$.
        01c0	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        01d0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        01e0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        01f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0200	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        0210	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        0220	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0230	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0240	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 4
    1.3.6.1.4.1.311.21.7: Flags = 0, Length = 2b
    Certificate Template Information
        Template=Kerberos Authentication(1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.33)
        Major Version Number=110
        Minor Version Number=0

    2.5.29.37: Flags = 0, Length = 2b
    Enhanced Key Usage
        Client Authentication (1.3.6.1.5.5.7.3.2)
        Server Authentication (1.3.6.1.5.5.7.3.1)
        Smart Card Logon (1.3.6.1.4.1.311.20.2.2)
        KDC Authentication (1.3.6.1.5.2.3.5)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

    1.3.6.1.4.1.311.21.10: Flags = 0, Length = 33
    Application Policies
        [1]Application Certificate Policy:
             Policy Identifier=Client Authentication
        [2]Application Certificate Policy:
             Policy Identifier=Server Authentication
        [3]Application Certificate Policy:
             Policy Identifier=Smart Card Logon
        [4]Application Certificate Policy:
             Policy Identifier=KDC Authentication

EFSRecovery: EFS Recovery Agent -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 21 (33)
    CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = 82000000 (-2113929216)
    CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
    CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  msPKI-Private-Key-Flag = 10 (16)
    CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 10230 (66096)
    CT_FLAG_EXPORTABLE_KEY -- 10 (16)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = EFSRecovery
  distinguishedName = EFSRecovery
  displayName = EFS Recovery Agent
  templateDescription = User
  pKIExtendedKeyUsage = 1.3.6.1.4.1.311.10.3.4.1 File Recovery
  pKIDefaultCSPs =
    0: Microsoft Enhanced Cryptographic Provider v1.0
    1: Microsoft Base Cryptographic Provider v1.0
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 6
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.8
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  5 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c e8 00 00 00  04 01 00 00 00 00 00 00   ................
        0010	14 00 00 00 04 00 d4 00  05 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 24 00   ...<.6^.......$.
        0090	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        00a0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        00b0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        00c0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00d0	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        00e0	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        00f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0100	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0110	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = 18
    Certificate Template Name (Certificate Type)
        EFSRecovery

    2.5.29.37: Flags = 0, Length = f
    Enhanced Key Usage
        File Recovery (1.3.6.1.4.1.311.10.3.4.1)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Key Encipherment (20)

EFS: Basic EFS -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 29 (41)
    CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = 82000000 (-2113929216)
    CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
    CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  msPKI-Private-Key-Flag = 10 (16)
    CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 10238 (66104)
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_EXPORTABLE_KEY -- 10 (16)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = EFS
  distinguishedName = EFS
  displayName = Basic EFS
  templateDescription = User
  pKIExtendedKeyUsage = 1.3.6.1.4.1.311.10.3.4 Encrypting File System
  pKIDefaultCSPs =
    0: Microsoft Enhanced Cryptographic Provider v1.0
    1: Microsoft Base Cryptographic Provider v1.0
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 3
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.6
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DU)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 20 01 00 00  3c 01 00 00 00 00 00 00   .... ...<.......
        0010	14 00 00 00 04 00 0c 01  06 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  01 02 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	07 02 00 00 00 00 24 00  ff 00 0f 00 01 05 00 00   ......$.........
        00d0	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        00e0	a9 36 5e 0a 00 02 00 00  00 00 24 00 ff 00 0f 00   .6^.......$.....
        00f0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0100	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 14 00   ...<.6^.........
        0110	94 00 02 00 01 01 00 00  00 00 00 05 0b 00 00 00   ................
        0120	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0130	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 01 05 00 00   ...<.6^.........
        0140	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        0150	a9 36 5e 0a 07 02 00 00                            .6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = 8
    Certificate Template Name (Certificate Type)
        EFS

    2.5.29.37: Flags = 0, Length = e
    Enhanced Key Usage
        Encrypting File System (1.3.6.1.4.1.311.10.3.4)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Key Encipherment (20)

DomainController: Domain Controller -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 29 (41)
    CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = 19000000 (419430400)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DIRECTORY_GUID -- 1000000 (16777216)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
    CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN -- 10000000 (268435456)
  msPKI-Private-Key-Flag = 0
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 1026c (66156)
    CT_FLAG_ADD_OBJ_GUID -- 4
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = DomainController
  distinguishedName = DomainController
  displayName = Domain Controller
  templateDescription = Directory e-mail replication
  pKIExtendedKeyUsage =
    0: 1.3.6.1.5.5.7.3.2 Client Authentication
    1: 1.3.6.1.5.5.7.3.1 Server Authentication
  pKIDefaultCSPs = Microsoft RSA SChannel Cryptographic Provider
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 4
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.15
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-498)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DD)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;ED)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 80 01 00 00  9c 01 00 00 00 00 00 00   ................
        0010	14 00 00 00 04 00 6c 01  08 00 00 00 05 00 38 00   ......l.......8.
        0020	10 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   ........h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	f2 01 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  00 02 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	04 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        00d0	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        00e0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        00f0	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 05 00 28 00   ...<.6^.......(.
        0100	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0110	90 d4 00 c0 4f 79 dc 55  01 01 00 00 00 00 00 05   ....Oy.U........
        0120	09 00 00 00 00 00 24 00  ff 00 0f 00 01 05 00 00   ......$.........
        0130	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        0140	a9 36 5e 0a 00 02 00 00  00 00 24 00 ff 00 0f 00   .6^.......$.....
        0150	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0160	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 14 00   ...<.6^.........
        0170	94 00 02 00 01 01 00 00  00 00 00 05 0b 00 00 00   ................
        0180	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0190	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 01 05 00 00   ...<.6^.........
        01a0	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        01b0	a9 36 5e 0a 07 02 00 00                            .6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = 22
    Certificate Template Name (Certificate Type)
        DomainController

    2.5.29.37: Flags = 0, Length = 16
    Enhanced Key Usage
        Client Authentication (1.3.6.1.5.5.7.3.2)
        Server Authentication (1.3.6.1.5.5.7.3.1)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

WebServer: Web Server -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 0
  msPKI-Certificate-Name-Flag = 1
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  msPKI-Private-Key-Flag = 0
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 10241 (66113)
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = WebServer
  distinguishedName = WebServer
  displayName = Web Server
  templateDescription = Computer
  pKIExtendedKeyUsage = 1.3.6.1.5.5.7.3.1 Server Authentication
  pKIDefaultCSPs =
    0: Microsoft RSA SChannel Cryptographic Provider
    1: Microsoft DH SChannel Cryptographic Provider
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 4
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.16
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  2 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c e8 00 00 00  04 01 00 00 00 00 00 00   ................
        0010	14 00 00 00 04 00 d4 00  05 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 24 00   ...<.6^.......$.
        0090	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        00a0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        00b0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        00c0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00d0	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        00e0	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        00f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0100	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0110	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = 14
    Certificate Template Name (Certificate Type)
        WebServer

    2.5.29.37: Flags = 0, Length = c
    Enhanced Key Usage
        Server Authentication (1.3.6.1.5.5.7.3.1)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

Machine: Computer -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 20 (32)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = 18000000 (402653184)
    CT_FLAG_SUBJECT_ALT_REQUIRE_DNS -- 8000000 (134217728)
    CT_FLAG_SUBJECT_REQUIRE_DNS_AS_CN -- 10000000 (268435456)
  msPKI-Private-Key-Flag = 0
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 10260 (66144)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = Machine
  distinguishedName = Machine
  displayName = Computer
  templateDescription = Computer
  pKIExtendedKeyUsage =
    0: 1.3.6.1.5.5.7.3.2 Client Authentication
    1: 1.3.6.1.5.5.7.3.1 Server Authentication
  pKIDefaultCSPs = Microsoft RSA SChannel Cryptographic Provider
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 5
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.14
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DC)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 20 01 00 00  3c 01 00 00 00 00 00 00   .... ...<.......
        0010	14 00 00 00 04 00 0c 01  06 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  03 02 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	07 02 00 00 00 00 24 00  ff 00 0f 00 01 05 00 00   ......$.........
        00d0	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        00e0	a9 36 5e 0a 00 02 00 00  00 00 24 00 ff 00 0f 00   .6^.......$.....
        00f0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0100	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 14 00   ...<.6^.........
        0110	94 00 02 00 01 01 00 00  00 00 00 05 0b 00 00 00   ................
        0120	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0130	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 01 05 00 00   ...<.6^.........
        0140	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        0150	a9 36 5e 0a 07 02 00 00                            .6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = 10
    Certificate Template Name (Certificate Type)
        Machine

    2.5.29.37: Flags = 0, Length = 16
    Enhanced Key Usage
        Client Authentication (1.3.6.1.5.5.7.3.2)
        Server Authentication (1.3.6.1.5.5.7.3.1)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

User: User -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 29 (41)
    CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = a6000000 (-1509949440)
    CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
    CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL -- 4000000 (67108864)
    CT_FLAG_SUBJECT_REQUIRE_EMAIL -- 20000000 (536870912)
    CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  msPKI-Private-Key-Flag = 10 (16)
    CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 1023a (66106)
    CT_FLAG_ADD_EMAIL -- 2
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_EXPORTABLE_KEY -- 10 (16)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = User
  distinguishedName = User
  displayName = User
  templateDescription = User
  pKIExtendedKeyUsage =
    0: 1.3.6.1.4.1.311.10.3.4 Encrypting File System
    1: 1.3.6.1.5.5.7.3.4 Secure Email
    2: 1.3.6.1.5.5.7.3.2 Client Authentication
  pKIDefaultCSPs =
    0: Microsoft Enhanced Cryptographic Provider v1.0
    1: Microsoft Base Cryptographic Provider v1.0
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 3
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.1
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DU)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c 20 01 00 00  3c 01 00 00 00 00 00 00   .... ...<.......
        0010	14 00 00 00 04 00 0c 01  06 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  01 02 00 00 05 00 38 00   ...<.6^.......8.
        0090	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        00a0	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        00b0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00c0	07 02 00 00 00 00 24 00  ff 00 0f 00 01 05 00 00   ......$.........
        00d0	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        00e0	a9 36 5e 0a 00 02 00 00  00 00 24 00 ff 00 0f 00   .6^.......$.....
        00f0	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0100	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 14 00   ...<.6^.........
        0110	94 00 02 00 01 01 00 00  00 00 00 05 0b 00 00 00   ................
        0120	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0130	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 01 05 00 00   ...<.6^.........
        0140	00 00 00 05 15 00 00 00  49 00 57 59 e3 a1 8d 3c   ........I.WY...<
        0150	a9 36 5e 0a 07 02 00 00                            .6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = a
    Certificate Template Name (Certificate Type)
        User

    2.5.29.37: Flags = 0, Length = 22
    Enhanced Key Usage
        Encrypting File System (1.3.6.1.4.1.311.10.3.4)
        Secure Email (1.3.6.1.5.5.7.3.4)
        Client Authentication (1.3.6.1.5.5.7.3.2)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

SubCA: Subordinate Certification Authority -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 0
  msPKI-Certificate-Name-Flag = 1
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
  msPKI-Private-Key-Flag = 10 (16)
    CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 102d1 (66257)
    CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT -- 1
    CT_FLAG_EXPORTABLE_KEY -- 10 (16)
    CT_FLAG_MACHINE_TYPE -- 40 (64)
    CT_FLAG_IS_CA -- 80 (128)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = SubCA
  distinguishedName = SubCA
  displayName = Subordinate Certification Authority
  templateDescription = Certification authority (CA)
  pKIExtendedKeyUsage =
  pKIDefaultCSPs = Microsoft Enhanced Cryptographic Provider v1.0
  pKICriticalExtensions =
    0: 2.5.29.15 Key Usage
    1: 2.5.29.19 Basic Constraints
  revision = 5
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.18
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_SIGNATURE
  pKIExpirationPeriod =  5 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c e8 00 00 00  04 01 00 00 00 00 00 00   ................
        0010	14 00 00 00 04 00 d4 00  05 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 24 00   ...<.6^.......$.
        0090	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        00a0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        00b0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        00c0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00d0	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        00e0	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        00f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0100	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0110	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = c
    Certificate Template Name (Certificate Type)
        SubCA

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Certificate Signing, Off-line CRL Signing, CRL Signing (86)

    2.5.29.19: Flags = 1(Critical), Length = 5
    Basic Constraints
        Subject Type=CA
        Path Length Constraint=None

Administrator: Administrator -- Auto-Enroll: Access is denied.
  msPKI-Enrollment-Flag = 29 (41)
    CT_FLAG_INCLUDE_SYMMETRIC_ALGORITHMS -- 1
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
  msPKI-Certificate-Name-Flag = a6000000 (-1509949440)
    CT_FLAG_SUBJECT_ALT_REQUIRE_UPN -- 2000000 (33554432)
    CT_FLAG_SUBJECT_ALT_REQUIRE_EMAIL -- 4000000 (67108864)
    CT_FLAG_SUBJECT_REQUIRE_EMAIL -- 20000000 (536870912)
    CT_FLAG_SUBJECT_REQUIRE_DIRECTORY_PATH -- 80000000 (-2147483648)
  msPKI-Private-Key-Flag = 10 (16)
    CTPRIVATEKEY_FLAG_EXPORTABLE_KEY -- 10 (16)
    CTPRIVATEKEY_FLAG_ATTEST_NONE -- 0
    TEMPLATE_SERVER_VER_NONE<<CTPRIVATEKEY_FLAG_SERVERVERSION_SHIFT -- 0
    TEMPLATE_CLIENT_VER_NONE<<CTPRIVATEKEY_FLAG_CLIENTVERSION_SHIFT -- 0
  flags = 1023a (66106)
    CT_FLAG_ADD_EMAIL -- 2
    CT_FLAG_PUBLISH_TO_DS -- 8
    CT_FLAG_EXPORTABLE_KEY -- 10 (16)
    CT_FLAG_AUTO_ENROLLMENT -- 20 (32)
    CT_FLAG_ADD_TEMPLATE_NAME -- 200 (512)
    CT_FLAG_IS_DEFAULT -- 10000 (65536)
  cn = Administrator
  distinguishedName = Administrator
  displayName = Administrator
  templateDescription = User
  pKIExtendedKeyUsage =
    0: 1.3.6.1.4.1.311.10.3.1 Microsoft Trust List Signing
    1: 1.3.6.1.4.1.311.10.3.4 Encrypting File System
    2: 1.3.6.1.5.5.7.3.4 Secure Email
    3: 1.3.6.1.5.5.7.3.2 Client Authentication
  pKIDefaultCSPs =
    0: Microsoft Enhanced Cryptographic Provider v1.0
    1: Microsoft Base Cryptographic Provider v1.0
  pKICriticalExtensions = 2.5.29.15 Key Usage
  revision = 4
  msPKI-Template-Schema-Version = 1
  msPKI-Template-Minor-Revision = 1
  msPKI-RA-Signature = 0
  msPKI-Minimal-Key-Size = 800 (2048)
  msPKI-Cert-Template-OID = 1.3.6.1.4.1.311.21.8.9007408.4333836.16203954.7714117.16001761.181.1.7
  msPKI-Supersede-Templates =
  msPKI-RA-Policies =
  msPKI-RA-Application-Policies =
  msPKI-Certificate-Policy =
  msPKI-Certificate-Application-Policy =
  dwKeySpec = AT_KEYEXCHANGE
  pKIExpirationPeriod =  1 Years
  pKIOverlapPeriod =  6 Weeks
"O:S-1-5-21-1498873929-1015914979-173946537-519G:S-1-5-21-1498873929-1015914979-173946537-519D:PAI(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;DA)(OA;;RPWPCR;0e10c968-78fb-11d2-90d4-00c04f79dc55;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;DA)(A;;CCDCLCSWRPWPDTLOSDRCWDWO;;;S-1-5-21-1498873929-1015914979-173946537-519)(A;;LCRPLORC;;;AU)"
        0000	01 00 04 9c e8 00 00 00  04 01 00 00 00 00 00 00   ................
        0010	14 00 00 00 04 00 d4 00  05 00 00 00 05 00 38 00   ..............8.
        0020	30 01 00 00 01 00 00 00  68 c9 10 0e fb 78 d2 11   0.......h....x..
        0030	90 d4 00 c0 4f 79 dc 55  01 05 00 00 00 00 00 05   ....Oy.U........
        0040	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0050	00 02 00 00 05 00 38 00  30 01 00 00 01 00 00 00   ......8.0.......
        0060	68 c9 10 0e fb 78 d2 11  90 d4 00 c0 4f 79 dc 55   h....x......Oy.U
        0070	01 05 00 00 00 00 00 05  15 00 00 00 49 00 57 59   ............I.WY
        0080	e3 a1 8d 3c a9 36 5e 0a  07 02 00 00 00 00 24 00   ...<.6^.......$.
        0090	ff 00 0f 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        00a0	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 00 02 00 00   I.WY...<.6^.....
        00b0	00 00 24 00 ff 00 0f 00  01 05 00 00 00 00 00 05   ..$.............
        00c0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        00d0	07 02 00 00 00 00 14 00  94 00 02 00 01 01 00 00   ................
        00e0	00 00 00 05 0b 00 00 00  01 05 00 00 00 00 00 05   ................
        00f0	15 00 00 00 49 00 57 59  e3 a1 8d 3c a9 36 5e 0a   ....I.WY...<.6^.
        0100	07 02 00 00 01 05 00 00  00 00 00 05 15 00 00 00   ................
        0110	49 00 57 59 e3 a1 8d 3c  a9 36 5e 0a 07 02 00 00   I.WY...<.6^.....


Template Extensions: 3
    1.3.6.1.4.1.311.20.2: Flags = 0, Length = 1c
    Certificate Template Name (Certificate Type)
        Administrator

    2.5.29.37: Flags = 0, Length = 2e
    Enhanced Key Usage
        Microsoft Trust List Signing (1.3.6.1.4.1.311.10.3.1)
        Encrypting File System (1.3.6.1.4.1.311.10.3.4)
        Secure Email (1.3.6.1.5.5.7.3.4)
        Client Authentication (1.3.6.1.5.5.7.3.2)

    2.5.29.15: Flags = 1(Critical), Length = 4
    Key Usage
        Digital Signature, Key Encipherment (a0)

CertUtil: -CATemplates command completed successfully.


Recommendation:
CA templates retrieved successfully. Review template configurations for security compliance.
