AD CS ESC9: Certificate Template Without SID Security Extension

ESC9 is a certificate-template setting: CT_FLAG_NO_SECURITY_EXTENSION (0x00080000) tells the CA to omit the SID security extension from issued certificates. The flag alone does not grant impersonation. The classic UPN-manipulation path also requires write access to the userPrincipalName of an account that can enroll in a published client-authentication template, the ability to authenticate as that enrolling account, and a KDC mapping policy that accepts weak UPN mapping when the certificate lacks a strong SID mapping. Microsoft Full Enforcement rejects certificates without a strong mapping; the StrongCertificateBindingEnforcement compatibility registry setting ceased to be supported with September 2025 updates. Do not present this path as working by default in a fully patched environment. A separate ESC6+ESC9 SID-in-SAN chain is outside this entry.