BrkrOps Blog
Field notes from Windows Server,
identity, and PKI.
Long-form technical writing from the BrkrOps team — Active Directory Certificate Services, PKI defence, identity, and Windows Server, written by the people who do this work for a living.
BrkrOps · PKI Operations
The CA you turned off.
You ran the removal wizard, the role came off cleanly, and somebody deleted the VM. Seven years later that CA is still in NTAuthCertificates, its private key is still in the migration folder next to the runbook with the password in it, and a certificate signed with it needs no request, no template and no CA — and leaves no serial number to revoke. DPERSIST1, the GoldenCert edge.
BrkrOps · PKI Operations
You reset her password.
The reset was fast and the ticket was correct. It also did not touch the certificate autoenrollment issued her years ago — which still authenticates as her, still hands back her new NT hash on request, and renews itself without ever asking for a password. No ESC number, no misconfiguration, just a missing line in the playbook.
BrkrOps · PKI Operations
Strongly mapped.
Full Enforcement killed the name-typing trick and closed a real hole. It also moved the authoritative statement of who a certificate belongs to out of the signed certificate and into an unsigned directory attribute — one a stale 2016 delegation still lets the help desk write. ESC14, the variant enforcement doesn't close.
BrkrOps · PKI Operations
Certificate request to inbox access in under three hours.
One certificate for a server that doesn't exist, approved in a glance by someone with forty-seven other things in their queue. A DNS record, a reverse proxy, harvested credentials, a mailbox forwarding rule — and email-based OTP hands over every code. Eight defences, all absent.
BrkrOps · PKI Operations
The garage didn't burn down.
43 Domain Admins, each managing "their" pair of domain controllers, each certain their corner is independent. Seven of them chained one delegation at a time is all it takes to own the forest — and afterwards they'll blame the hypervisor. Silos are not segmentation.
BrkrOps · PKI Operations
The registration authority makes the certificate.
NDES signs whatever it's asked to sign — it never validates the subject name in a request. With local admin on the NDES box, an attacker repoints the MSCEP registry at a weak template and enrolls domain admin authentication certificates issued by your own CA. Seven gaps, all of them known.
BrkrOps · PKI Operations
The certificates that break WiFi.
Two NDES service certificates expired three days ago and nobody noticed until Intune-managed devices stopped connecting to the corporate WiFi. The defaults don't auto-renew — here's the one-hour template fix that makes them renew themselves for the life of the service.
BrkrOps · PKI Operations
Code signing.
An attacker finds an enterprise code-signing certificate on a developer's laptop — no HSM, no audit, no monitoring. Six minutes later he owns the enterprise. A code-signing certificate is a credential that grants trusted execution: it's Tier 0, not a developer tool.
BrkrOps · PKI Operations
The model has no answer.
An attacker pivots from a Tier 2 workstation to owning the whole forest through SCCM. The tiering model calls SCCM, Intune, Entra Connect, backup, and hypervisors Tier 1 — but each holds unrestricted administrative access to Tier 0. Why the guidance has an answer nobody implements.
BrkrOps · PKI Operations
The Notary Cannot Carry the Seal
An HSM-backed CA can pass every health check and still be unable to issue a certificate or publish a CRL — because its signing key lives across a network round trip. Why CRL publication is the failure you cannot absorb, and what to monitor instead.
BrkrOps · PKI Operations
Two writes.
Two things on a certificate template are called Write — the template ACL and the Supply-in-the-request setting. Only one is safe to delegate. Confuse them, and a helpful admin hands an attacker a template they can quietly rewrite into a domain-admin path.
BrkrOps · PKI Strategy
Cloud PKI Is Free. Sort Of.
Intune Cloud PKI is included with Microsoft 365 E5 as of July 1, 2026 — but almost no enterprise is 100% E5. The real five-year TCO of Cloud PKI vs ADCS, and where ADCS still earns its keep in 2026.
BrkrOps · PKI Operations
The Companies I Won't Give My Data To
What twelve years inside other people's PKI taught me about who actually protects your data — and who just says they do.
BrkrOps · PKI Operations
The Locked Door
Why only deploying what we planned for avoids a painful experience.
BrkrOps · PKI Operations
Your backup is the breach.
Why backing up your Tier 0 systems the same way you back up file servers is how an attacker walks off with your CA's private key — and how to back up DCs and CAs without handing them Tier 0.
Truvald · ADCS Security
Build the root the right way, sign your sub, get one year back.
Why a CAPolicy.inf root issues one-year subordinate certificates no matter what you typed — and the ValidityPeriodUnits issuance ceiling that actually controls it.
Truvald · ADCS Security
Time to come back to CDP.
Why your CRL distribution point doesn't belong on the CA, and probably shouldn't be in LDAP either.
Truvald · ADCS Security
Reading an AD Certificate Template: Every Attribute, Explained
A field guide to the attributes behind a certutil -dsTemplate dump: what each one does, and which ones you can actually change.
Truvald · ADCS Security
NAC with X.509: the good, the bad, and the ugly.
What 802.1X with EAP-TLS actually buys you, where the exceptions creep in, and why NAC is a PKI project — not a network project.
Truvald · ADCS Security
It's not ADCS.
Where certificate templates actually live, and what that means for hardening your PKI.
Truvald · ADCS Security
A CA is a CA.
Why your Certification Authority should do exactly one thing, and what to keep off it.
Truvald · ADCS Security
You checked your CAs.
How to replace a default certificate template, in three steps.
Truvald · ADCS Security
Twenty-five years.
Why the default certificate templates in every ADCS install are the foundation of most ESC findings.