AD CS ESC4

ESC4 is a certificate-template control weakness: a principal has effective write/control rights over a template object in Active Directory. Those rights may let the principal change the template into an ESC1-like state, but certificate abuse still depends on CA publication, enrollment/issuance controls, and whether the resulting certificate maps to the target under current domain-controller policy. Template modification alone does not guarantee domain compromise.