AD CS ESC5: Vulnerable PKI Object Access Control

ESC5 covers excessive control over Active Directory Certificate Services objects in the forest-wide Configuration naming context. One documented child-domain-to-forest escalation uses LocalSystem on a writable child-domain controller to modify permissions on the Public Key Services container, create a certificate template, and add that template to the certificateTemplates list of a pKIEnrollmentService object for a CA trusted for domain authentication. The new template must let a controlled child-domain principal enroll and request an authentication certificate carrying the forest-root Enterprise Admin identity. WRITE access to pKIEnrollmentService alone does not create a template or guarantee forest escalation; success also depends on CA trust, replication, and certificate mapping. Updated domain controllers move to Full Enforcement by default with the February 2025 security update, and the compatibility override is unsupported after the September 9, 2025 update; a SAN UPN alone is not sufficient unless the certificate is otherwise strongly mapped to the target.