AD CS, or Active Directory Certificate Services, is Microsoft’s certificate authority and public key infrastructure (PKI) component. It issues and manages trusted digital certificates for users, computers, and services, allowing systems to prove identity and establish encrypted connections. In an Active Directory environment, AD CS often supports authentication, smart cards, VPNs, TLS, and other trust-based workflows.
It matters because certificates are powerful identity tokens. If AD CS is misconfigured or compromised, an attacker may be able to request a certificate for another account, abuse overly permissive templates, or sign authentication material that the domain will trust. Defenders treat AD CS as a Tier 0 asset: restrict admin access, review certificate templates and enrollment permissions, protect the CA server, and monitor certificate issuance for unusual requests. Strong logging helps expose certificate abuse that can otherwise look like normal administration.