6.3.10 Select an AD CS, delegation or GPO branch
AD cheatsheet | §6 — AD Notes | §6.5.3 — Read output
A concrete service, configuration or object-right clue that selects one of these method families. These are conditional branches, not a default catalogue to run blindly.
Where to look: AD CS: inspect enrollment services/templates, enrollment rights and applicable certificate/authentication conditions. Delegation: inspect exact flags, SPNs, allowed targets and controlled principals. GPO: inspect effective links/scope, writable components, affected objects and refresh/trigger.
Expected behavior / secure boundary: Certificates, delegation, trusts and linked policies can all be legitimate. A tool's vulnerable label or an isolated setting is only a candidate. The complete conjunction of effective rights, service configuration and authentication/trigger conditions determines whether a path exists.
These commands are study references for a later scoped exercise. Replace placeholders for the selected environment; the output below is synthetic, not a recorded target result. Commands that collect secrets, request tickets, create sessions or change directory state require their stated prerequisites.
6.3.10.1 Baseline — Shell
Run: Kali / Linux with compatible Certipy. Requires: Directory/CA connectivity, explicit credentials and a concrete certificate-service clue. Effect: Enumerates configuration; a candidate label is not certificate issuance or account access.
command -v certipy-ad || command -v certipy
certipy-ad find -u 'USER@DOMAIN' -p 'PASSWORD' -dc-ip DC_IP \
-enabled -vulnerable -stdout
What this checks: This command belongs only to the certificate branch after AD CS evidence is found. The full owning procedure separates template/CA enumeration, certificate requests, authentication and cleanup; GPO/delegation have different commands and prerequisites.
6.3.10.2 Interpret the output
Normalized observations: the following is a synthetic interpretation example, not literal output from one command. Placeholder ciphers and secrets are deliberately unusable.
Template: WorkstationAuth
Enrollment: Domain Users
Client Authentication EKU: present
Requester-controlled identity/SAN behavior: not established
CA policy and effective template ACL: not established
| Interpreted result | What it establishes | Required next check | Continue at |
|---|---|---|---|
| Enrollment allowed | A principal may be able to request this template. | Confirm effective CA/template rights and issuance policy. | §6.3.10.1 — Select an AD CS, delegation or GPO branch |
| Client Authentication | A relevant certificate use is advertised. | Check identity mapping and all conditions of the selected method. | §6.3.2.1 — Classify recovered credentials and their scope |
| Missing SAN/ACL/CA facts | No complete certificate attack path is shown. | Collect the missing configuration; do not label the domain compromised. | §6.3.10.1 — Select an AD CS, delegation or GPO branch |
Stop when: A concrete clue selects one extension and its complete missing conditions are listed.
Revisit only when: New CA/template, delegation, GPO or effective-right evidence appears.
6.3.10.3 Decide and continue
| Result | Decision | Next numbered section |
|---|---|---|
| Enabled after validation | All selected branch prerequisites align: open its complete conditional procedure. | §6.3.10.4 — Select an AD CS, delegation or GPO branch |
| Ruled out in this context | Only a legitimate feature is present: record it and return to stronger evidence. | §6.2.5.1 — Enumerate and validate effective object permissions |
| Inconclusive / failed check | Collector labels lack configuration detail: validate manually before an attack choice. | §6.3.10.1 — Select an AD CS, delegation or GPO branch |
6.3.10.4 Tooling and complete procedure
Certipy/Certify for the selected certificate investigation; PowerView/LDAP/RSAT for delegation and GPO facts. Use version-matched documentation from the canonical procedure; no coercion or relay baseline is introduced. The commands above are extracts from the owning procedure; Windows-host and Kali/target tool availability must be checked in that environment. No installation or target execution is implied by this page.
Open the owning procedure, prerequisites and complete variants. Study mechanisms and alternatives. Shared concepts. §6.6.2 — Choose an approach.