AD CS ESC16

ESC16 is a CA-wide configuration issue in which the SID security extension szOID_NTDS_CA_SECURITY_EXT (OID 1.3.6.1.4.1.311.25.2) is disabled, so certificates issued by that CA omit the ObjectSID binding. This omission does not itself let an enrollee choose an arbitrary SAN or impersonate another account. Under current strong certificate mapping, a documented impersonation path combines ESC16 with ESC6 on the same CA, an enrollable client-authentication template, and a request containing both the target UPN and SID in the SAN. Legacy weak-mapping paths had additional conditions and should not be assumed to work on updated domain controllers.