AD CS Authentication Certificate Risk Review

AD CS templates, effective enrollment permissions, and CA policy influence which identities can obtain authentication certificates. Weak subject/SAN controls combined with permissive enrollment and authentication use may let an issued certificate authenticate as another identity; stolen or forged authentication certificates may also serve as credentials. This is a defensive certificate-risk review mapped to ATT&CK T1649, not an enrollment-abuse or certificate-use procedure.