Blog Post

Core Infrastructure and Security Blog
20 MIN READ

Secure Configuration and Hardening of Active Directory Certificate Services

RonArestia's avatar
RonArestia
Icon for Microsoft rankMicrosoft
Oct 21, 2025
My name is Ron Arestia, and I am a Security Researcher with Microsoft’s Detection and Response Team (DART). We respond to customer cybersecurity incidents to assist with containment and recovery from...
Updated Oct 22, 2025
Version 2.0
PKI
RonArestia
Rafal_Fitt's avatar
Rafal_Fitt
Iron Contributor
Oct 24, 2025

"Do your Domain Admins really need any certificates outside of maybe smart cards?"
yes, to logon via RDP using certificates (instead username + password)

"Are you certain all Domain Computers need a Server Authentication EKU certificate? Are you allowing user endpoints to host services that require it?"
A Server Authentication EKU certificate can be used to protect RDP.