AD CS ESC10: Weak Schannel UPN Certificate Mapping

ESC10 is a weak certificate-to-account mapping condition in Schannel. If the Schannel service accepting client certificates has the UPN mapping bit (0x4) enabled in CertificateMappingMethods, and an assessment account can change the UPN of an account that can enroll in a client-authentication template, the issued certificate may authenticate as the account named by its SAN UPN. The operator must also separately be able to authenticate as the victim account for certificate enrollment, for example with its credentials or a valid Kerberos credential cache; UPN write access alone does not provide victim authentication. This commonly targets machine accounts without an existing UPN. The certificate may still carry the victim account's SID; Schannel UPN mapping is distinct from Kerberos PKINIT. Certipy find does not inspect the Schannel server registry, so verify the effective setting with the server owner. Microsoft no longer supports StrongCertificateBindingEnforcement after updates released on or after 2025-09-09; do not describe setting that value to 0 as a current prerequisite.