(07)專案管理 » 01_外部專案

N bookmark20250529113929916258883991 "ADCS Web Enrollment Enabled for high-privileged accounts

" Enabling ADCS Web Enrollment for high-privileged accounts increases the risk of credential theft, as attackers could exploit web-based vulnerabilities (like MITM or phishing) to intercept or forge certificates. This could lead to privilege escalation and domain compromise if abused for unauthorized authentication. "The following approaches are recommended to mitigate this potential vulnerability.

Enable Extended Protection for Authentication (EPA) on the ADCS Server.

Disable NTLM on the ADCS Server

Enforce SMB and LDAP Signing

"