AD CS Web Enrollment is a web-based certificate issuance interface in Active Directory Certificate Services. It can become a high-risk target when it accepts relayable authentication, because an attacker may use coerced credentials to request certificates that enable persistent impersonation or broader authentication abuse.
What AD CS Web Enrollment Is For
AD CS Web Enrollment is a certificate request front end, so its core value is convenience: users or systems can submit enrollment requests through a web interface instead of using only native certificate tooling. That convenience also widens the trust boundary, because the web layer becomes part of the path from authentication to certificate issuance.
In practice, the danger is not the page itself but what it can authorize if the surrounding controls are weak. When a certificate request path can be reached with relayed or coerced authentication, the web enrollment service may help an attacker turn a short-lived access path into a certificate-backed identity that lasts much longer.
Why Relayable Authentication Makes It Dangerous
AD CS Web Enrollment becomes especially sensitive when it accepts authentication that can be relayed from another session. In that condition, the web interface can be used as an issuance target after coerced authentication, which is why it appears in many AD CS abuse chains.
NTLM Relay Guide is the most direct companion concept here, because relay prevention measures such as signing, channel binding and Extended Protection are what determine whether the web enrollment path can be abused this way. The issue is not merely login interception, but trust being transferred into a certificate request.
AD CS Security Guide covers the broader abuse patterns around AD CS, including certificate template abuse and strong certificate mapping, which is useful context for understanding why a single issued certificate can create persistent access.
How Certificate Abuse Changes the Identity Risk
Once an attacker obtains a certificate through abuse of the web enrollment path, the impact can extend beyond the original compromised session. A certificate can authenticate as the affected principal, support impersonation, and in some environments survive password changes until it is revoked or otherwise invalidated.
That makes the security problem materially different from ordinary credential theft. The attacker is not only stealing a login, but potentially obtaining a reusable authentication artifact that can be leveraged across services where certificate-based trust is accepted.
MITRE ATT&CK T1649 Steal or Forge Authentication Certificates Guide is relevant because certificate theft and forgery are the downstream behaviors that turn issuance abuse into durable access.
Defensive Focus Areas for Exposure and Monitoring
Exposure assessment starts with finding where AD CS Web Enrollment is deployed, whether it is reachable from untrusted networks, and whether it is protected by the right web authentication hardening. If the service is exposed more broadly than intended, it can become a relay target that attackers actively look for.
Monitoring should look for certificate issuance patterns that do not fit normal enrollment behavior, especially unusual templates, anomalous request timing, and suspicious relationships between authentication events and certificate issuance events. The web enrollment service should be treated as a security-sensitive issuance point, not just an administrative convenience.
Active Directory Security Monitoring and Event IDs Guide supports the event-correlation side of this problem, while BloodHound and Active Directory Attack Path Guide helps frame AD CS exposure as part of broader attack-path reduction.
What Remediation Looks Like After Abuse
If web enrollment has been abused, remediation is broader than changing one password. Organisations should review issued certificates, revoke those that were improperly obtained, and confirm whether any certificate mappings, authentication paths or dependent sessions remain active.
Where the compromise path involved relayable authentication, the control fix should address the relay condition itself, not just the certificate outcome. That usually means hardening the enrollment endpoint, reducing exposure, and removing any unnecessary paths that allow coerced authentication to reach issuance.
NTLM Relay Guide is also the most practical remediation companion because it focuses on the network and authentication controls that stop the abuse path before certificate issuance occurs.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1649 — Steal or Forge Authentication Certificates | Covers certificate theft and forgery as the abuse path after insecure issuance. |
| Recommendation — Map certificate abuse activity to T1649 and hunt for forged or stolen certificate use. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Web enrollment depends on strong user authentication before certificate issuance. |
| IA-5 — Authenticator Management | Issued certificates and related secrets require lifecycle control and revocation handling. | |
| IA-9 — Service Identification and Authentication | AD CS web enrollment can involve non-human or service-based authentication paths. | |
| Recommendation — Enforce strong user authentication before allowing certificate enrollment requests. Manage certificate issuance, rotation and revocation as part of authenticator lifecycle control. Authenticate service-to-service certificate enrollment paths with strong mutual trust controls. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Relayable web enrollment creates insecure authentication conditions for certificate issuance. |
| NHI-05 — Overprivileged NHI | Misissued certificates can confer excessive authentication power to the resulting identity. | |
| NHI-07 — Long-Lived Secrets | Certificates can remain useful long after the initial compromise if not revoked promptly. | |
| Recommendation — Prevent relayed or coerced authentication from reaching certificate enrollment endpoints. Limit certificate templates and mappings so issued certificates cannot grant excessive access. Shorten certificate validity and revoke compromised certificates quickly. | ||
Related resources from NHI Mgmt Group
- What should teams do first when AD CS Web Enrollment reports the target certificate authority as offline on a separate server?
- Why does AD CS Web Enrollment need delegated access to the certificate authority in a split-server setup?
- What do administrators often get wrong when configuring AD CS Web Enrollment on a server separate from the CA?
- What happens when AD CS Web Enrollment is deployed on a separate server without the required delegation?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org