Active Directory Certificate Services (AD CS) is Microsoft’s Windows role for issuing, managing, and validating digital certificates inside a domain. It is a core part of Public Key Infrastructure (PKI), providing certificate enrollment, renewal, and trust services for users, devices, and services. In practice, AD CS lets Windows environments use certificates for logon, encryption, code signing, and mutual authentication.
AD CS matters because certificates can act as identity proof. If certificate templates, enrollment permissions, or CA authorization rules are misconfigured, a low-privilege user may be able to obtain a certificate that represents a more privileged identity. Attackers look for these trust mistakes to escalate privileges or bypass authentication, while defenders treat AD CS as Tier 0 infrastructure and lock it down with strict template review, minimal enrollment rights, auditing, and separate administration.