Get on Top of Active Directory Certificate Services and Stay There 

Active Directory Certificate Services (AD CS) is the Public Key Infrastructure (PKI) backbone for a large share of Microsoft environments. Features like Windows Hello for Business and 802.1X depend on it. But in most organizations, AD CS is also one of the fastest paths an attacker has to full domain compromise.

Darryl Baker and Sander Berkouwer dive into the out-of-the-box settings on default installations of AD CS, how admins may have misconfigured its certificate templates and how adversaries commonly abuse these vulnerabilities to get to enterprise admin privileges in Active Directory and even the Global Administrator role in Entra.