Control ID: CA-TEMPLATE-003
Control Name: Template Schema Version Validation
Severity: High
Status: Failure
Certificate Authority: securetron-lab-ISSUINGCA
Execution Time: 2025-10-15 22:43:13
Duration: 00:00:00.0273523

Expected Result:
Certificate templates should not use prohibited schema versions: 1, 2

Evidence:
Template Schema Version Analysis for securetron-lab-ISSUINGCA:
  Templates Found: 11
  Prohibited Versions: 1, 2 (from parameters.json)
  Non-Compliant Templates: 11

Template Schema Versions:
  ✗ DirectoryEmailReplication: Version 2 (NON-COMPLIANT (matches prohibited version 2))
  ✗ DomainControllerAuthentication: Version 2 (NON-COMPLIANT (matches prohibited version 2))
  ✗ KerberosAuthentication: Version 2 (NON-COMPLIANT (matches prohibited version 2))
  ✗ EFSRecovery: Version 1 (NON-COMPLIANT (matches prohibited version 1))
  ✗ EFS: Version 1 (NON-COMPLIANT (matches prohibited version 1))
  ✗ DomainController: Version 1 (NON-COMPLIANT (matches prohibited version 1))
  ✗ WebServer: Version 1 (NON-COMPLIANT (matches prohibited version 1))
  ✗ Machine: Version 1 (NON-COMPLIANT (matches prohibited version 1))
  ✗ User: Version 1 (NON-COMPLIANT (matches prohibited version 1))
  ✗ SubCA: Version 1 (NON-COMPLIANT (matches prohibited version 1))
  ✗ Administrator: Version 1 (NON-COMPLIANT (matches prohibited version 1))

Validation Results:
  Compliant Templates: 0
  Non-Compliant Templates: 11
  Overall: NON-COMPLIANT


Recommendation:
Update the following templates to use compliant schema versions: DirectoryEmailReplication, DomainControllerAuthentication, KerberosAuthentication, EFSRecovery, EFS, DomainController, WebServer, Machine, User, SubCA, Administrator
