AD CS: a template finding is configuration, not an intrusion

The label is the checker’s name for settings

An audit tool prints a template name and a short label for a combination of settings it cares about. That label is the tool’s category. The evidence is the settings list under it: who may enroll, which uses the template allows, and how the subject name is chosen. Read those lines. Do not expand the label into a story about someone requesting a certificate.

This page does not walk through requesting or using a certificate. The finding is input to a configuration change, not a procedure.

Copy the card, not a narrative

Write the template’s name, the CA that offers it, each setting the tool printed, and the group or account granted enrollment. If the export says nothing about issued certificates, write “issuance not in this export.” A later question about whether anyone enrolled is a different source: the CA’s issued-certificate view or the CA audit log.

Do not add steps, sample names, or “what an attacker would do.” Those sentences are not in the finding, and they do not belong in the ticket.

The change is to the template, under a ticket

The owner of the CA edits the template settings the card listed, in the templates console, and records which setting changed. After the change, the same read-only check should stop listing that template for that reason. Already issued certificates, if the issuance source shows any, are a separate review. The template edit does not speak about them.

Worked case: a label pasted as a compromise

The lab export names template LabWifi on CA lab-ca-01. The card lists enrollee-chosen subject, a sign-in use, and enrollment for Domain Users. It lists no issued certificates. A draft incident says the domain was compromised through that template.

The corrected ticket is a configuration change: template name, CA, the three settings as printed, and “issuance not in this export.” It asks the CA owner to change the subject setting and the enrollment group. It does not describe how a certificate could be requested, and it does not disable accounts. If someone later asks whether a certificate was issued, that question waits for the CA log, which this card does not contain.

template: LabWifi
ca: lab-ca-01
settings as printed: subject chosen by enrollee; sign-in use; enrollment Domain Users
issued certificates in this export: none
ticket type: configuration change
not in this card: a request, an issuance, or a sign-in