PKINIT

This PKINIT workflow abuses an AD CS ESC1-capable authentication template: an enrolled principal requests a certificate naming another account, then uses its private key in Kerberos PKINIT to request a TGT for the account to which the KDC maps it. Success depends on CA/template permissions and issuance controls, a trusted issuing CA, a suitable authentication EKU, and current certificate-mapping policy. A TGT confirms the identity accepted by the KDC; it does not prove further service authorization.