An AD CS template is a certificate profile in Microsoft Active Directory Certificate Services. It defines who can enroll, what key usage and extended key usage are allowed, whether the requester can supply a subject name, and which identities the resulting certificate can represent. In practice, the template controls how certificates are issued and what trust they carry inside a Windows domain.
It matters because a weak template can become an escalation path. If low-privileged users can request a certificate that is trusted for authentication, they may be able to impersonate another user or computer, bypassing password-based controls. Attackers look for overly broad enrollment rights, managerless approval, and templates that allow subject alternative names or authentication EKUs. Defenders should review templates regularly, remove unnecessary enrollments, and lock down templates used for privileged identities so certificates cannot be turned into reusable access tokens.