AD CS Template Permission Discovery

Enumerating Active Directory Certificate Services (AD CS) templates and their access-control settings can reveal which domain principals may read, enroll in, or modify certificate templates. This is domain permission discovery (ATT&CK T1069.002 as a broader mapping); enumeration alone does not request a certificate or establish that a configuration is exploitable.