How does AD CS ESC1 work?

How ESC1 turns a template into an identity spoofing path

ESC1 matters because the certificate template itself becomes the abuse primitive. If a requester can control the subject or subject alternative name, the issued certificate can represent a different identity than the one that requested it. That breaks the trust assumption behind certificate-based authentication and turns a misconfiguration into a privilege-escalation path.

The practical issue is not just “can I enroll?”, but “what identity will the certificate assert once issued?”. In an ad cs environment, that distinction determines whether a certificate is merely a credential or a credential that can be used to speak as another principal.

When defenders review templates, they should treat enrollee-supplied subject fields as a high-risk design choice, especially when the template can be used for authentication. A template that allows identity override can be sufficient for abuse even if the rest of the certificate service is otherwise functioning normally.

Why attacker abuse of ESC1 is so effective

ESC1 is effective because certificates are often trusted more broadly than passwords or interactive logons. Once an attacker can obtain a certificate that maps to a privileged account, they may use it to authenticate to services that accept certificate-based trust, including paths that are easier to overlook than conventional password theft.

That makes ESC1 attractive in environments where certificate issuance is not tightly reviewed. The attacker does not need to break the cryptography; they only need a template that issues a valid certificate with attacker-controlled identity attributes.

AD CS Security Guide covers the broader certificate-template abuse patterns around ESC1 and the related hardening steps that reduce this class of exposure.

What to check and tighten first in AD CS

Start by identifying every template that permits requester-supplied subject data and every enrollment path that can reach those templates. The risk becomes materially worse when those templates are also available to broad groups, delegated administrators, or automation paths that were never intended to request privileged certificates.

Then verify whether certificate mapping is strict enough to prevent a misleading certificate from being accepted as a higher-value identity. If the template can mint a cert that downstream systems treat as authoritative, the abuse window is larger than the enrollment permission alone suggests.

Active Directory and Entra ID Hardening Guide is useful where certificate abuse intersects with privileged identity paths, tiering, and hybrid identity controls.

Risk and Threat Considerations

ESC1 creates a direct identity impersonation risk: the misconfigured template can let an untrusted requester obtain a certificate that names a more privileged principal. That can convert a routine enrollment weakness into authentication bypass, privilege abuse, and persistence if the certificate remains trusted after the initial compromise.

Failure mechanism: The template accepts requester-controlled identity attributes, issues a valid certificate, and downstream authentication or mapping logic accepts that certificate as if it belonged to the impersonated user.

Impact: Attackers can impersonate privileged accounts, expand access beyond the original requester, and retain a reusable trust artifact that may outlive the session or password used to obtain it.

Practitioner Guidance

What to verify: Confirm which templates allow enrollee-supplied subject or SAN values, which principals can enroll, and whether approval is required before issuance. The key question is not whether the CA is online, but whether the template can issue a certificate that asserts the wrong identity.

Decision rule: If a template can authenticate as a privileged or broadly trusted principal, treat it as a priority fix even before you finish full environment-wide inventory. Restrict enrollment, remove identity override where possible, and review any template that was designed for convenience rather than explicit trust.

Practitioner takeaway: ESC1 is dangerous because it turns certificate issuance into identity substitution, so the control objective is to make every issued certificate reflect only the identity that was actually authorised to receive it.

Related resources from NHI Mgmt Group

• AD CS ESC1
• Why do Windows admin gateways create such high-risk identity exposure when AD CS is nearby?
• How do security teams know whether AD CS is becoming an abuse path?
• Who should own AD CS risk when it can affect both Active Directory and Entra?