Hardening ADCS

A CA can issue credentials for any account in the domain. That makes it equivalent to a domain controller for security purposes, so it belongs in tier 0: separate administrative accounts, restricted logon, no browsing, no shared management tooling.

• Only tier-0 administrators log on interactively to the CA
• No email, browsing or third-party agents on the host
• Backups and key material stored under the same tier-0 controls
• Change control on templates, CA settings and role services

The ATT&CK mitigation M1015 recommends exactly this: treat CA servers and anything holding CA certificates as tier-0 assets, harden abusable settings, and consider disabling SAN usage in authentication protocols to enforce strict mapping.

ADCS auditing is not fully enabled by default, which is why many incidents are reconstructed long after the fact. Enable it deliberately and ship the events somewhere durable.

ADCS drifts. Someone adds a template, widens a group, re-enables an old endpoint. A one-off audit ages quickly, which is why the useful pattern is continuous assessment with the findings tracked to closure.

PKI Trust Auditor performs discovery, configuration, cryptographic, template and operational checks across ADCS and reports findings with evidence and remediation guidance, so the state can be reviewed after every change.