Topic starter
27/08/2026 2:11 pm
TL;DR: CISA’s AA26-237A shows that two critical infrastructure organisations can face the same red-team tradecraft and yet diverge sharply on detection, with default Machine Account Quota and ESC1 ADCS templates turning ordinary domain users into certificate-based domain impersonators, according to SafeBreach. The lesson for identity teams is that cloud and on-prem controls fail together when privilege, visibility, and certificate issuance are governed as separate problems.
Editorial analysis by NHI Mgmt Group, based on content published by SafeBreach: “A Tale of Two SOCs: SafeBreach Coverage for CISA Alert AA26-237A”.
Key questions
Q: What breaks when Machine Account Quota is left at the Windows default?
A: It gives ordinary domain users enough identity capacity to create machine accounts that can become part of a privilege chain.
Q: Why do weak AD CS templates matter so much in domain compromise?
A: Because a template that lets the requester choose the subject disconnects the certificate from the real identity behind the request.
Q: How do security teams detect certificate abuse in real environments?
A: Teams should look for unexpected signed binaries, unusual publisher lineage, companion DLL loading, and malware that appears only after trusted execution paths are used.
Practitioner guidance
- Zero out Machine Account Quota Set Machine Account Quota to zero unless a documented operational need exists, and restrict any exception to the smallest possible administrative group.
- Harden AD CS templates Review every certificate template for enrollee-supplied subject settings, weak enrollment restrictions, and any path that lets low-privilege users mint identity-bearing certificates.
- Treat certificates as identity credentials Inventory which services accept certificate-based authentication and map those certificates back to the business identities and privileges they can impersonate.
Bottom line: Default Machine Account Quota and weak AD CS templates create a direct identity path from ordinary user access to domain impersonation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/08/2026 2:12 pm
Machine Account Quota is a governance decision, not a convenience setting. The default value effectively grants low-privilege users a pathway to create their own trust-bearing objects inside the domain. That assumption was designed for administrative flexibility, not for environments where machine accounts can become ingredients in impersonation chains. The implication is that join rights must be treated as privileged identity capacity, not operational background noise.
A question worth separating out:
A: Accountability usually sits with the teams that own identity governance, directory administration, and cloud access control, because these groups define permissions, credential policy, and enforcement. Security leadership should ensure review cadence, logging, and response ownership are documented. The practical test is whether each risky permission or credential exception has a named control owner.
👉 Read our full editorial: CISA AA26-237A shows how weak ADCS and MQA become domain compromise