ESC8 involves an NTLM relay attack targeting the AD CS web enrollment service. It continues to be the most frequently identified privilege escalation path involving certificate services during Active Directory security assessments. The issue remains widespread because the Web Enrollment role enables HTTP and NTLM authentication by default. When combined with an authentication coercion technique such as PetitPotam, ESC8 can allow a malicious actor to obtain a certificate and authenticate as a domain controller. The recommended approach is to uninstall Web Enrollment when it is unnecessary. If the service must remain operational, HTTPS and Extended Protection for Authentication (EPA) should be enforced.
According to reports uploaded to the Netwrix PingCastle public statistics platform using the “compare with statistics” feature, the A-CertEnrollHttp finding appeared 6,487 times as of November 2026. This makes it the most frequently reported escalation path associated with Active Directory Certificate Services (AD CS) among the issues monitored by the platform.
A-CertEnrollHttp and A-CertEnrollChannelBinding collectively identify the conditions associated with ESC8. Despite extensive documentation of this attack path, its prevalence remains high because the underlying exposure originates from an insecure default configuration.
Understanding ESC8
ESC8 is an attack technique that uses NTLM authentication relay against the AD CS web enrollment interface. Installing the Certification Authority Web Enrollment role makes the HTTP-based certsrv endpoint available. If this endpoint permits NTLM authentication without safeguards such as Extended Protection for Authentication (EPA) or channel binding, a malicious actor can forward an intercepted NTLM authentication attempt to the service. This enables certificate requests to be submitted under another identity.
An attacker can use a technique such as PetitPotam to force a domain controller to initiate authentication toward an attacker-controlled system. The authentication exchange can then be relayed to the certificate enrollment interface. If successful, the attacker receives a certificate that can be used to authenticate as the domain controller. This creates a direct route toward a DCSync attack and potentially complete compromise of the Active Directory domain.
The MITRE ATT&CK framework associates this attack chain with two techniques. T1557 (Adversary-in-the-Middle) describes the authentication coercion and relay mechanism. T1649 (Steal or Forge Authentication Certificates) addresses the abuse of authentication certificates obtained through the attack.
What Makes ESC8 So Widespread?
The Web Enrollment role activates HTTP access and NTLM authentication as part of its standard installation. Securing the service through HTTPS and mandatory EPA requires additional administrative configuration. Without awareness of these requirements, organizations may unintentionally maintain an environment vulnerable to NTLM relay.
This exposure generally results from overlooked configuration requirements rather than an intentional decision to permit insecure certificate enrollment. An administrator may deploy a certificate authority and activate Web Enrollment for a particular operational need. Several months later, the service may remain enabled without ongoing attention to its configuration or the requirement to enforce EPA.
ESC8 findings are also identified in environments with otherwise mature security controls. However, the frequency of such findings has declined as awareness of this attack technique has increased.
What Are the Risks of a Certificate Obtained Through ESC8?
The severity of ESC8 largely depends on the capabilities provided by a successfully issued certificate. An NTLM authentication session is temporary, whereas a certificate obtained through the relay attack remains usable until its expiration or revocation. Certificate validity periods commonly extend to one year or longer.
Another significant concern is that the certificate supports authentication through multiple protocols. A malicious actor can use Kerberos or Schannel, which enables certificate-based authentication over TLS. Consequently, restrictions imposed on NTLM authentication do not necessarily prevent the certificate from being used.
When ESC8 is combined with authentication coercion, the attack requires relatively limited prerequisites. The attacker needs network connectivity to a vulnerable web enrollment service and access to a machine that can be forced to initiate authentication. These conditions can be sufficient to establish an attack path leading to privileges equivalent to those of a Domain Admin.
How PingCastle Identifies ESC8 Exposure
PingCastle examines certificate authorities and certificate enrollment servers discovered within the network. For each identified system, the tool checks two interfaces: the Web Enrollment endpoint (certsrv/certrqxt.asp) and the Certificate Enrollment Service (CES) endpoint. When either interface responds successfully through unencrypted HTTP, PingCastle generates a domain-level finding. The exposure indicates that NTLM authentication could potentially be relayed to a certificate enrollment service accessible over HTTP.
The A-CertEnrollChannelBinding check addresses enrollment services operating over HTTPS. It identifies endpoints that support encrypted connections but do not require channel binding. Without this protection, NTLM authentication relay may remain possible despite the use of HTTPS.
Remediating ESC8 While Maintaining Certificate Enrollment
The first remediation step is to determine whether the Web Enrollment role is required. If no systems or users depend on the certsrv interface to submit certificate requests, uninstalling the role eliminates the unnecessary exposure. Removing the service is the most straightforward mitigation and should be evaluated before making other configuration changes.
Where Web Enrollment remains necessary, enabling HTTPS is insufficient by itself. The service must also enforce Extended Protection for Authentication or channel binding to prevent attackers from relaying NTLM authentication over an encrypted connection. Detailed configuration instructions are provided in Microsoft’s KB5005413 guidance on protecting AD CS against NTLM relay attacks.
Additional risk-reduction measures include limiting network connectivity to the certificate authority’s web interface, disabling NTLM authentication where Kerberos can meet operational requirements, and installing security updates that address known authentication coercion techniques. A broader assessment should also cover other insecure AD CS configurations that may coexist with ESC8 exposure.
