AD CS ESC1: Enrollee-Supplied Subject

AD CS ESC1 is abuse of a published AD CS certificate template that permits an enrollee-supplied subject/SAN, grants the enrolling principal Enroll rights, supports an authentication-capable certificate, and lacks required manager approval or authorized signatures. An authorized assessment can request a certificate carrying the target account UPN and, where supported, SID. If issued, the PFX can be tested through PKINIT. Outcome depends on CA issuance policy, certificate mapping policy, and domain-controller configuration. Certipy may also attempt optional NT-hash retrieval; TGT issuance and hash retrieval are separate outcomes.