What happens when an attacker abuses Active Directory Certificate Services through NTLM relay and certificate enrollment?

How NTLM relay turns AD CS certificate enrollment into elevated access

active directory certificate services becomes dangerous when the attacker can coerce or intercept authentication and then complete certificate enrollment on behalf of a more privileged identity. The key issue is not just obtaining a certificate, but obtaining one that the directory or the relying service will accept as proof of that identity. Once that trust is established, the certificate can outlive the original relay event and become a reusable path into higher privilege.

In practical terms, the relay gives the attacker a way to swap a low-value network interaction for a high-value authentication artifact. If enrollment templates, HTTP-based endpoints, or certificate mappings are permissive, the attacker can pivot from a trapped NTLM exchange to a certificate that authenticates as a user, server, or domain controller. That is why this pattern often produces a bigger impact than a one-time session hijack.

The important architectural detail is that certificate-based authentication changes the attack surface from password or hash theft to trusted credential issuance. Once a certificate exists, the attacker may no longer need the original NTLM relay path at all, which makes the compromise easier to operationalise and harder to reason about as a single incident.

Why the resulting access is so hard to contain

The danger escalates when the issued certificate is accepted for logon, service authentication, or privileged directory operations. A certificate that is valid for an administrative principal can grant broad access without ever revealing a password, and a certificate tied to a domain controller can be even more damaging because it can support directory impersonation and follow-on privilege escalation.

This is why Ultimate Guide to NHIs and the What are Non-Human Identities section are useful context for practitioners who want to think in terms of the credentialed actor, not just the transport used to obtain it. In the same way, NHI Lifecycle Management Guide is relevant because lifecycle blind spots are what let issued credentials remain useful after the original compromise path should have been closed.

Containment is difficult because certificates are often treated as legitimate trust material once issued. If inventory is weak, teams may not know which endpoints, templates, or principals can mint a usable certificate. If revocation is weak, they may know a certificate is bad but still be unable to remove its practical value quickly enough to prevent lateral movement or domain-wide abuse.

The issue is therefore both authentication and governance. The attack succeeds when issuance, mapping, and revocation are all trusted more than they should be, and when defenders assume the original NTLM relay is the only thing that needs to be fixed.

What defenders should watch for in AD CS relay abuse

Defenders should treat unexpected certificate enrollment, especially over HTTP-based enrollment paths, as a high-signal event when it is preceded by NTLM coercion or suspicious authentication relay behaviour. A certificate request that appears normal in isolation may be highly suspicious when the requester, template, and subject name do not align with the real host or user context.

Useful corroborating evidence includes unusual enrollment from non-administrative systems, certificate subjects that map to privileged accounts, and sudden use of certificate-based authentication from identities that normally do not use it. Cisco Active Directory credentials breach is a reminder that AD credential compromise and lateral movement often travel together once directory trust is broken, while The 52 NHI Breaches Report shows how frequently stolen or abused identity material becomes the practical bridge from initial access to broader compromise.

For deeper reading on certificate handling and trust chains, NIST SP 800-57 Key Management is useful for the lifecycle and trust-management perspective, while the CA/Browser Forum baseline requirements help frame issuance and revocation discipline as a control problem, not just a certificate-store problem.

Risk and Threat Considerations

The main risk is that a single relayed enrollment can create a durable authentication path that bypasses the original foothold. When the issued certificate maps to a privileged account or a high-trust server identity, the attacker can turn a transient network abuse into repeatable access and broader directory compromise.

Failure mechanism: NTLM relay abuses a trusted authentication exchange to satisfy certificate enrollment, and weak template, mapping, or revocation controls allow the resulting certificate to function as a valid high-privilege authenticator.

Impact: The attacker may impersonate privileged users or infrastructure, expand from a low-privilege foothold to domain-level control, and persist even after the original relay path is blocked.

Practitioner Guidance

What to verify: Confirm which enrollment endpoints accept HTTP, which templates permit requester-supplied subject or SAN data, and which certificate mappings can authenticate privileged principals. If you cannot answer those three questions quickly, you do not yet have enough visibility to trust the environment.

Common mistake: Treating revocation as a cleanup step instead of part of the attack path. If a certificate can still authenticate, then the compromise is not contained, even if the original NTLM relay vector has been disabled.

Practitioner takeaway: The decisive control is not merely stopping NTLM relay, it is preventing relayed authentication from becoming a valid, reusable certificate-based trust relationship with privileged reach.

Related resources from NHI Mgmt Group

• What happens when NTLM relay reaches Active Directory Certificate Services?
• How should security teams reduce NTLM relay risk in Active Directory?
• Why does Active Directory Certificate Services increase identity risk?
• What breaks when Active Directory Certificate Services templates are too permissive?