Active Directory Certificate Service (AD CS)

Active Directory Certificate Services (AD CS) is a Windows Server feature that allows you to build and manage PKI certificates used in software security systems.

Asset Types Fetched

• Certificates

Before You Begin

Required Ports

Axonius must be able to communicate with the value supplied in ADCS Server via the following ports:

• 135 (RPC)
• 445 (SMB)
• Random port in the range 1024-65535

Authentication Methods

The AD CS adapter supports the following authentication methods:

• NTLM (default) — Standard Windows NTLM challenge-response authentication.
• Kerberos — Kerberos-based authentication. When using Kerberos, the user name must be in the format username/domain/realm. Two additional optional fields are available: Kerberos AES Key and Kerberos Host (KDC).

APIs

Axonius uses the Certutil module.

Required Permissions

The value supplied in User Name and Password must be able to execute PowerShell code which queries the ADCS server for information on the systems managed by that server. The configured user must have permission to run the following PowerShell commands:

• (Get-Service -Name CertSvc).Status
• certutil -view csv

The configured user must have Read permission in the Certificate Authority.
To enable this permission:

1. Open the Certification Authority management console (certsrv.msc).
2. Right-click the CA name and select Properties.
3. Click the Security tab.
4. Check the user or group that requires access.
5. Ensure that the Read permission is enabled.

The value supplied in User Name and Password must have the following permissions in order to fetch assets:

• Local admin permissions.
• Access RPC on the ADCS server.
• Execute PowerShell on the ADCS server and access the IPC$ share on the ADCS server.
• Read and Write Access to ADMIN$ share on the ADCS server. Alternatively, create an 'axonius' folder inside the \localhost\ADMIN$\ directory and ensure the Axonius account has Full Permissions to read and write to this newly created folder.

Supported From Version

Supported from Axonius version 6.1

Setting Up AD CS to Work with Axonius

If your environment requires WMI port configuration or a custom Windows share, complete the steps described in Active Directory Initial Setup before connecting this adapter.

Connecting the Adapter in Axonius

1. Navigate to the Adapter Catalog, search for Active Directory Certificate Service (AD CS), and select the adapter.
2. Click Add Connection.
3. Provide the following parameters.

Required Parameters

1. Authentication - Select the authentication method: NTLM (default) or Kerberos. If you select Kerberos, the following optional fields for authentication may be configured:
   • Kerberos AES Key (optional) - A cryptographic key, either 128 or 256 bits in length, used to secure communication by encrypting and decrypting messages exchanged between the client and the server.
   • Kerberos Host (KDC) (optional) - The Kerberos Key Distribution Center (KDC) that will be used to authenticate. If this parameter is not specified, the domain will be used.
2. ADCS Server - The hostname of the domain controller with the ADCS service.
3. User Name and Password - The credentials for a user account that has the Required Permissions to execute PowerShell code which queries the ADCS server for information on the systems managed by that server. When using Kerberos the user name must be in the format username/domain/realm.

Optional Parameters

1. Custom Share Name - The name of the Windows Share on the specified host, for example, AxoniusShare$. If you do not specify a name, the adapter will use Admin$. For more information, see Active Directory Initial Setup.
2. Custom Files Directory - The name of the directory to use within the specified Share, for example, AxoniusDirectory. If you do not specify a name, the adapter will use axonius.
3. Custom Working Directory - If file sharing is restricted in the domain, specify the physical path of the share specified in Custom Share Name.
4. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.
5. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in ADCS Server via the value supplied in HTTPS Proxy.
6. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Filter Certificates By Template (semi-colon separated) - Enter a semicolon-separated list of templates to exclude from the fetch.
2. Filter Certificates by Expiration Date in the next X days - Specify a numerical value to set a future expiration date to filter certificates by.